672c58d8a5ac859b088401547e7e79f115b0341cf8c5a053454359f0af5581f0

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 02:20

Target

f7111740c7e617e3abd069ebf18e815d_JaffaCakes118.exe
Size

4.7MB
MD5

f7111740c7e617e3abd069ebf18e815d
SHA1

35095c9e868b1364063873156839b810e854b4fc
SHA256

672c58d8a5ac859b088401547e7e79f115b0341cf8c5a053454359f0af5581f0
SHA512

f6e1a24640f1e45cd19d23b7b52a582ed4484c49524e43dff31a19bcbba616c7e16af989ed283ae4cbdc5cd802cb29bb8fffcf24b7737816a549f5cb696c4be8
SSDEEP

49152:084P690mfNjDz5dT6xpCoJUGpDeCRyTH8zgiWFNBiPilPyGo97uTfJPilPyGo97E:SP6NjDixc2UGpLzgUPilPgYPilPg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3056	1520	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 3056	1520	f7111740c7e617e3abd069ebf18e815d_JaffaCakes118.exe	28
PID 1520 wrote to memory of 3056	1520	f7111740c7e617e3abd069ebf18e815d_JaffaCakes118.exe	28
PID 1520 wrote to memory of 3056	1520	f7111740c7e617e3abd069ebf18e815d_JaffaCakes118.exe	28
PID 1520 wrote to memory of 3056	1520	f7111740c7e617e3abd069ebf18e815d_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f7111740c7e617e3abd069ebf18e815d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f7111740c7e617e3abd069ebf18e815d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 140
  2⤵
  - Program crash
  PID:3056