c291cba41eb789ea0a1bdc1290bcfd65a43823fa13128358c55be522ec3dbb72

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 20:44

Target

f1e369fd57a29155a43a8e2ca5b616af_JaffaCakes118.exe
Size

79KB
MD5

f1e369fd57a29155a43a8e2ca5b616af
SHA1

c4bded7920f5f0d6e306daf12d83c431f6e6d0e1
SHA256

c291cba41eb789ea0a1bdc1290bcfd65a43823fa13128358c55be522ec3dbb72
SHA512

7859bc19f7d410980ae73bd8087c13c69e1447878353a73bf924011c9006b903e9eaf8119726c205ca90194c37367423d755d8dca1f56fda7ea86b6784816de2
SSDEEP

768:cE3fkClcNqWKihbhooe/AZFjFb2Q2HOoVdYfpciy4UIzQZgJ8je0fhzXUuKlWdTd:jvkClcN9tek7Xofydy46C4eqUHlaTDp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2924	2136	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2924	2136	f1e369fd57a29155a43a8e2ca5b616af_JaffaCakes118.exe	28
PID 2136 wrote to memory of 2924	2136	f1e369fd57a29155a43a8e2ca5b616af_JaffaCakes118.exe	28
PID 2136 wrote to memory of 2924	2136	f1e369fd57a29155a43a8e2ca5b616af_JaffaCakes118.exe	28
PID 2136 wrote to memory of 2924	2136	f1e369fd57a29155a43a8e2ca5b616af_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f1e369fd57a29155a43a8e2ca5b616af_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f1e369fd57a29155a43a8e2ca5b616af_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 92
  2⤵
  - Program crash
  PID:2924