99735c4a330d80918982b17439527f45a296cf8eadbed9a357f797cc6a80e895

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 11:50

Target

94bae111661aa4fa57e097a8303aa4ab_JaffaCakes118.exe
Size

100KB
MD5

94bae111661aa4fa57e097a8303aa4ab
SHA1

672fae590206a6aacb884c3531541076c51e063a
SHA256

99735c4a330d80918982b17439527f45a296cf8eadbed9a357f797cc6a80e895
SHA512

84912a88f20c3121cbe502f52f4828005c984eb90c1f271dfd38601a2057d6619bf9bea4c67e0536edbae82de23841dc3ad201dee087c5901dc0bc17b785fa22
SSDEEP

3072:oVSk8eNW2ZyKTKbxy2FBB3Z73eIRZwfJnzm:GSkBW2EKTKbxfBpZ7SfBm

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1724 1756 WerFault.exe 94bae111661aa4fa57e097a8303aa4ab_JaffaCakes118.exe

pid	pid_target	process	target process
1724	1756	WerFault.exe	94bae111661aa4fa57e097a8303aa4ab_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

94bae111661aa4fa57e097a8303aa4ab_JaffaCakes118.exe

description	pid	process	target process
PID 1756 wrote to memory of 1724	1756	94bae111661aa4fa57e097a8303aa4ab_JaffaCakes118.exe	WerFault.exe
PID 1756 wrote to memory of 1724	1756	94bae111661aa4fa57e097a8303aa4ab_JaffaCakes118.exe	WerFault.exe
PID 1756 wrote to memory of 1724	1756	94bae111661aa4fa57e097a8303aa4ab_JaffaCakes118.exe	WerFault.exe
PID 1756 wrote to memory of 1724	1756	94bae111661aa4fa57e097a8303aa4ab_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\94bae111661aa4fa57e097a8303aa4ab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\94bae111661aa4fa57e097a8303aa4ab_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 36
2⤵
- Program crash
PID:1724