7152201233fd830708fc3f78f06534fe3f63acf58e1619da31b6a5ce80714285

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 14:52

Target

f3b8261e7b45594fc95edbb128c03767_JaffaCakes118.exe
Size

165KB
MD5

f3b8261e7b45594fc95edbb128c03767
SHA1

4238d9efc121435de35613329e9ba5453a86d900
SHA256

7152201233fd830708fc3f78f06534fe3f63acf58e1619da31b6a5ce80714285
SHA512

5ad0490e44565b4ecbdc2cd448806ea5745ce2601e89caeb601c0be971a103e4849d2a5f63b790cf1ec177527cb083f043925304c608aaab000158d281d9affd
SSDEEP

3072:hstqlDOl97O29ztFp+0WH9HQ3Zz8tjWgf1KNWMIU38ziZ:cnhO2FtDAHshgjW0cWMI2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1976	1688	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1976	1688	f3b8261e7b45594fc95edbb128c03767_JaffaCakes118.exe	28
PID 1688 wrote to memory of 1976	1688	f3b8261e7b45594fc95edbb128c03767_JaffaCakes118.exe	28
PID 1688 wrote to memory of 1976	1688	f3b8261e7b45594fc95edbb128c03767_JaffaCakes118.exe	28
PID 1688 wrote to memory of 1976	1688	f3b8261e7b45594fc95edbb128c03767_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f3b8261e7b45594fc95edbb128c03767_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3b8261e7b45594fc95edbb128c03767_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 88
  2⤵
  - Program crash
  PID:1976