fe0cf59614aada6fb4d44a835aadf1fa9804adf9a9406b3c360d200a30cd64f3

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 14:02

Target

aec43148506c068f3d9429782b615d95_JaffaCakes118.exe
Size

92KB
MD5

aec43148506c068f3d9429782b615d95
SHA1

5e48babdacd3066b8858663e44b7749fb203e54a
SHA256

fe0cf59614aada6fb4d44a835aadf1fa9804adf9a9406b3c360d200a30cd64f3
SHA512

f275d6af7e73ae132546c514ba68e246d51e38273ceedc269fe92efdfbc20ddb5d0be0baa1e8eca1b51716c5522937a9a2d2dda39b2c17bdf8e3ae563d166adf
SSDEEP

1536:+nvb3auZj/Lypt8JDgJPKVyLWbAV36/D85CXBLybTHwapyEhM5IuQdgf6s:UT3TzypyJDgJPKVyabXr85KdyHHwapyH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2408	2404	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2408	2404	aec43148506c068f3d9429782b615d95_JaffaCakes118.exe	28
PID 2404 wrote to memory of 2408	2404	aec43148506c068f3d9429782b615d95_JaffaCakes118.exe	28
PID 2404 wrote to memory of 2408	2404	aec43148506c068f3d9429782b615d95_JaffaCakes118.exe	28
PID 2404 wrote to memory of 2408	2404	aec43148506c068f3d9429782b615d95_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\aec43148506c068f3d9429782b615d95_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aec43148506c068f3d9429782b615d95_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 128
  2⤵
  - Program crash
  PID:2408