d9f79cda5ecab48bae1fb436eed39a1905810defe4b39d92afffb354b0ec7c4e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 16:22

Target

25b186ec1997727edec9e181222f58f0_JaffaCakes118.exe
Size

321KB
MD5

25b186ec1997727edec9e181222f58f0
SHA1

415f4919400e4a77ae43ca646ae28360c5e51d76
SHA256

d9f79cda5ecab48bae1fb436eed39a1905810defe4b39d92afffb354b0ec7c4e
SHA512

86cb230a86675ebd068eba892c67a8eb9ee3e497d1dffa56b262a9708459c7ee0850641b0cf2e86084635a6b791e8256a5b1b5207b4c095fa65be50ca60f6584
SSDEEP

6144:rNxa/EJddK7vwK1poH7td/tQqG56Prd3Z5NBA3r12Ii:rO/YddK7vw0oHprG5+3a7O

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1028	2460	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 1028	2460	25b186ec1997727edec9e181222f58f0_JaffaCakes118.exe	28
PID 2460 wrote to memory of 1028	2460	25b186ec1997727edec9e181222f58f0_JaffaCakes118.exe	28
PID 2460 wrote to memory of 1028	2460	25b186ec1997727edec9e181222f58f0_JaffaCakes118.exe	28
PID 2460 wrote to memory of 1028	2460	25b186ec1997727edec9e181222f58f0_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\25b186ec1997727edec9e181222f58f0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\25b186ec1997727edec9e181222f58f0_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 116
  2⤵
  - Program crash
  PID:1028

memory/2460-0-0x0000000000180000-0x00000000001D5000-memory.dmp

Filesize
340KB

Download