1491e24a768cb197cedf5e97ea37d711cd75f0845b4f188dc2b9fc2820fbf2a6

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 00:10

Target

31c008cd6f131f1c1070fe7fa72df413_JaffaCakes118.exe
Size

103KB
MD5

31c008cd6f131f1c1070fe7fa72df413
SHA1

0d47edbe64bc57e2882e26ac026e617e96f5092c
SHA256

1491e24a768cb197cedf5e97ea37d711cd75f0845b4f188dc2b9fc2820fbf2a6
SHA512

6364e5392c1e51d341f405dab9c37d3b1d6fec4437e93fca8edcb9378a37ac290e32b3516d101ce47815c9712b7be40bd2d31a9bc49332e79815c791372a866c
SSDEEP

1536:0+2AI9M8cTOHIT1whnT6hV6FwGh1zK6Ux4oVkDTDlNzx33A5T9zz/CazIFaVS+1B:J2AEM8IOQAXhbFoyT+5T9f/CkIF4wgb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2900	2972	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2900	2972	31c008cd6f131f1c1070fe7fa72df413_JaffaCakes118.exe	28
PID 2972 wrote to memory of 2900	2972	31c008cd6f131f1c1070fe7fa72df413_JaffaCakes118.exe	28
PID 2972 wrote to memory of 2900	2972	31c008cd6f131f1c1070fe7fa72df413_JaffaCakes118.exe	28
PID 2972 wrote to memory of 2900	2972	31c008cd6f131f1c1070fe7fa72df413_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\31c008cd6f131f1c1070fe7fa72df413_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\31c008cd6f131f1c1070fe7fa72df413_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 276
  2⤵
  - Program crash
  PID:2900