d059eae51d4df81131bcef43574a58ca29597282e07a4e03d98d91fa454f1efd

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 18:31

Target

477957a9d5444dd4afa4fc01f3d8f510_JaffaCakes118.exe
Size

21KB
MD5

477957a9d5444dd4afa4fc01f3d8f510
SHA1

21bd80e32011d084b2a4efa13d2ec33742a6847f
SHA256

d059eae51d4df81131bcef43574a58ca29597282e07a4e03d98d91fa454f1efd
SHA512

bd0f3b67b899ead270a911f54b655e6700c42bcfe7807ad19b6650b5bca9df547d69991be85c2af8aab49109fcebaf4ba605c1c47ae710b5fa7e2ed76569e4d9
SSDEEP

384:i8XSvVHJlUNaT1AK7PY2WNTEbSIy6tWjbaaSIS5RqDTink:ihvVHnUNMAugIaSIS5RYg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2816	2156	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2156	477957a9d5444dd4afa4fc01f3d8f510_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2816	2156	477957a9d5444dd4afa4fc01f3d8f510_JaffaCakes118.exe	28
PID 2156 wrote to memory of 2816	2156	477957a9d5444dd4afa4fc01f3d8f510_JaffaCakes118.exe	28
PID 2156 wrote to memory of 2816	2156	477957a9d5444dd4afa4fc01f3d8f510_JaffaCakes118.exe	28
PID 2156 wrote to memory of 2816	2156	477957a9d5444dd4afa4fc01f3d8f510_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\477957a9d5444dd4afa4fc01f3d8f510_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\477957a9d5444dd4afa4fc01f3d8f510_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 108
  2⤵
  - Program crash
  PID:2816