19fe0ab399f44ceaf27bfb5c55afe870617186d48f29781ee446cc810863aeb4

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 07:11

Target

713715cb726c2e39d782e3696d4c6bbc_JaffaCakes118.exe
Size

25KB
MD5

713715cb726c2e39d782e3696d4c6bbc
SHA1

9b77e2b7937e1913bf225578d4621a4e5f343024
SHA256

19fe0ab399f44ceaf27bfb5c55afe870617186d48f29781ee446cc810863aeb4
SHA512

555cff7ed82fdb3fdf482b2c2fe2066431343bed4565d73d77e7971bdbb66ac5f54d2cc2cfa36460e271364ed1c231a49f55945b415f87110dc36efac97ea691
SSDEEP

384:hPcXKGCx5Kc9kO2TGWcNxqreFOSkOk5roKiHs+:1c6sgkvazNxxzkOmt+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2144	2484	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2144	2484	713715cb726c2e39d782e3696d4c6bbc_JaffaCakes118.exe	28
PID 2484 wrote to memory of 2144	2484	713715cb726c2e39d782e3696d4c6bbc_JaffaCakes118.exe	28
PID 2484 wrote to memory of 2144	2484	713715cb726c2e39d782e3696d4c6bbc_JaffaCakes118.exe	28
PID 2484 wrote to memory of 2144	2484	713715cb726c2e39d782e3696d4c6bbc_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\713715cb726c2e39d782e3696d4c6bbc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\713715cb726c2e39d782e3696d4c6bbc_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 760
  2⤵
  - Program crash
  PID:2144

memory/2484-0-0x0000000000160000-0x000000000016A000-memory.dmp

Filesize
40KB

Download