6de0ee2ea30d2753225be81ecf4d677a84d96968446b89c1357fae4becb21c53

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 05:35

Target

0b2b0c56099a391dc6ea451b68103058_JaffaCakes118.exe
Size

467KB
MD5

0b2b0c56099a391dc6ea451b68103058
SHA1

beb62e2fe9e7632843293fe3596073fc36eda140
SHA256

6de0ee2ea30d2753225be81ecf4d677a84d96968446b89c1357fae4becb21c53
SHA512

8ccd7fe7d8795cd58b9bf9647b25025277c5cc4cff10d91536ab4b539cd83984a4a399c5f36be87e78415eaa1ac5d5bade5bd2159b80f07e474e9c6983afa9be
SSDEEP

12288:ztbWWtT0AS4kJpUCDN1H8YcOHedVlUX5o9:lBtTXS5HZnckyDGO9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2044	2168	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2044	2168	0b2b0c56099a391dc6ea451b68103058_JaffaCakes118.exe	28
PID 2168 wrote to memory of 2044	2168	0b2b0c56099a391dc6ea451b68103058_JaffaCakes118.exe	28
PID 2168 wrote to memory of 2044	2168	0b2b0c56099a391dc6ea451b68103058_JaffaCakes118.exe	28
PID 2168 wrote to memory of 2044	2168	0b2b0c56099a391dc6ea451b68103058_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0b2b0c56099a391dc6ea451b68103058_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b2b0c56099a391dc6ea451b68103058_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 120
  2⤵
  - Program crash
  PID:2044