4553612d3ca05658c535ca268487f808b1913a67fa6cb671b07829175a149745

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:09

Target

6966f212a42d5f344f344be199d2617d_JaffaCakes118.exe
Size

68KB
MD5

6966f212a42d5f344f344be199d2617d
SHA1

455b483a7b5558cc5dd1ce784f897131134995b0
SHA256

4553612d3ca05658c535ca268487f808b1913a67fa6cb671b07829175a149745
SHA512

8e87d2d4494a6a23894a20728f9961adcf7aa036f2daf72f77827653d21b5ee47fc973f5bd2a13a3acf3699037dace3e9f8b10e68651efb8fdeb880713990a29
SSDEEP

1536:H6ALFmjhCd2sP2BENvqWUNDNgRsVjxjFlGXsMaDLmpdg3iJ1pcIsm:H68FmjhCd+29+DKRsV9jFs1aD6pC3iJ9

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1660 1940 WerFault.exe 6966f212a42d5f344f344be199d2617d_JaffaCakes118.exe

pid	pid_target	process	target process
1660	1940	WerFault.exe	6966f212a42d5f344f344be199d2617d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6966f212a42d5f344f344be199d2617d_JaffaCakes118.exe

description	pid	process	target process
PID 1940 wrote to memory of 1660	1940	6966f212a42d5f344f344be199d2617d_JaffaCakes118.exe	WerFault.exe
PID 1940 wrote to memory of 1660	1940	6966f212a42d5f344f344be199d2617d_JaffaCakes118.exe	WerFault.exe
PID 1940 wrote to memory of 1660	1940	6966f212a42d5f344f344be199d2617d_JaffaCakes118.exe	WerFault.exe
PID 1940 wrote to memory of 1660	1940	6966f212a42d5f344f344be199d2617d_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6966f212a42d5f344f344be199d2617d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6966f212a42d5f344f344be199d2617d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 36
2⤵
- Program crash
PID:1660