e2a3b99570070a7c3dd270e3201c75ea7d45b7517240ca7331d992b416c3184a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 19:10

Target

f423e92d6707de2f8d45b7acd51ea2cc_JaffaCakes118.exe
Size

4KB
MD5

f423e92d6707de2f8d45b7acd51ea2cc
SHA1

9281830762ea4ab4627facdb49c3c876e63eeba9
SHA256

e2a3b99570070a7c3dd270e3201c75ea7d45b7517240ca7331d992b416c3184a
SHA512

5f93894350fc3f17a5f76c634c2a70f1d87afc163666722cf2e60dab2f4f8774c1dd16d58b24e49824278ab7799379affad9fae818ecddfad922021ffd3e5784
SSDEEP

48:qlcy7+4uiSEu7A9NIX9rAMlpQ4C/W1LdIZWXHW3h55WwG:EV7puinuJZAMk47EWGRnWw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2172	3008	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2172	3008	f423e92d6707de2f8d45b7acd51ea2cc_JaffaCakes118.exe	29
PID 3008 wrote to memory of 2172	3008	f423e92d6707de2f8d45b7acd51ea2cc_JaffaCakes118.exe	29
PID 3008 wrote to memory of 2172	3008	f423e92d6707de2f8d45b7acd51ea2cc_JaffaCakes118.exe	29
PID 3008 wrote to memory of 2172	3008	f423e92d6707de2f8d45b7acd51ea2cc_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\f423e92d6707de2f8d45b7acd51ea2cc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f423e92d6707de2f8d45b7acd51ea2cc_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 72
  2⤵
  - Program crash
  PID:2172