67204b283d826ad27b8ce2d5a97058d5b99bc07865581e6701b118c4e8f9acd0

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 20:11

Target

60f697e108c7adedcebc3600a89c886d_JaffaCakes118.exe
Size

120KB
MD5

60f697e108c7adedcebc3600a89c886d
SHA1

97ba989e41459bf336a455defea210f4ae90d1bc
SHA256

67204b283d826ad27b8ce2d5a97058d5b99bc07865581e6701b118c4e8f9acd0
SHA512

7aeb61a3911ed988a1d571e06c37c1687ce1fffd1d8614d443af75abc0eb9ac4d0587438e49aac4e94ea81fc6b95bc9f5a656b694efece0a3d7387176a793079
SSDEEP

3072:1JDLlzKwMZS5jIwcOnwwcJogyAUU4JQbH8zlf5paZOfa8:1JBKwnjIwcOwwc+gNdaaZOt

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2752 2656 WerFault.exe 60f697e108c7adedcebc3600a89c886d_JaffaCakes118.exe

pid	pid_target	process	target process
2752	2656	WerFault.exe	60f697e108c7adedcebc3600a89c886d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

60f697e108c7adedcebc3600a89c886d_JaffaCakes118.exe

description	pid	process	target process
PID 2656 wrote to memory of 2752	2656	60f697e108c7adedcebc3600a89c886d_JaffaCakes118.exe	WerFault.exe
PID 2656 wrote to memory of 2752	2656	60f697e108c7adedcebc3600a89c886d_JaffaCakes118.exe	WerFault.exe
PID 2656 wrote to memory of 2752	2656	60f697e108c7adedcebc3600a89c886d_JaffaCakes118.exe	WerFault.exe
PID 2656 wrote to memory of 2752	2656	60f697e108c7adedcebc3600a89c886d_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\60f697e108c7adedcebc3600a89c886d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\60f697e108c7adedcebc3600a89c886d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 36
2⤵
- Program crash
PID:2752