fbc4f5e911967b3410d9f431df73e702a455a754080e5900074c4a38aed2059b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 15:34

Target

fa9c91bb5c227a219e85ea0090c16b43_JaffaCakes118.exe
Size

56KB
MD5

fa9c91bb5c227a219e85ea0090c16b43
SHA1

f62af0880deea2e0ca9ff1d281d26914c043725c
SHA256

fbc4f5e911967b3410d9f431df73e702a455a754080e5900074c4a38aed2059b
SHA512

af0c013b326490b19932cef3490a135616b6d9934ead5b187ee12bdd88859a62d198138edf6662da4daaa4e86bd1d982fcfe45f89bc8c6ee12f19e7ea233b787
SSDEEP

1536:mfcMX1X0wdmEb13UwdFYTeiDsqNkQx4S9NRE/xs979srn4:mv1XNmEt9PYSinmQ/N6/OZ2rn4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1416	1972	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1416	1972	fa9c91bb5c227a219e85ea0090c16b43_JaffaCakes118.exe	28
PID 1972 wrote to memory of 1416	1972	fa9c91bb5c227a219e85ea0090c16b43_JaffaCakes118.exe	28
PID 1972 wrote to memory of 1416	1972	fa9c91bb5c227a219e85ea0090c16b43_JaffaCakes118.exe	28
PID 1972 wrote to memory of 1416	1972	fa9c91bb5c227a219e85ea0090c16b43_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\fa9c91bb5c227a219e85ea0090c16b43_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa9c91bb5c227a219e85ea0090c16b43_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 36
  2⤵
  - Program crash
  PID:1416