ad9d3b87c46bfd5f204ac3c4c8b66bb1f2854d60d37f4be179ba4f9a5555cdc1

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 12:05

Target

b8859852fde574aa9fb11a651b038f58_JaffaCakes118.exe
Size

100KB
MD5

b8859852fde574aa9fb11a651b038f58
SHA1

438a257f6309e50edc01e8f16f2196c2a2f86671
SHA256

ad9d3b87c46bfd5f204ac3c4c8b66bb1f2854d60d37f4be179ba4f9a5555cdc1
SHA512

28be8601b48bdb2ee6d037991cacbb33dfc06476c629f1b8aedeeba080c4ad5f9db3b94bfcc1da99e420e6da2330a2f5ab47b631873602a0fb68e40c551b62d0
SSDEEP

3072:oVSk8eNW2ZyKTKbxy2FBB3Z73eIRZwfJnzm:GSkBW2EKTKbxfBpZ7SfBm

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2176 1696 WerFault.exe b8859852fde574aa9fb11a651b038f58_JaffaCakes118.exe

pid	pid_target	process	target process
2176	1696	WerFault.exe	b8859852fde574aa9fb11a651b038f58_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b8859852fde574aa9fb11a651b038f58_JaffaCakes118.exe

description	pid	process	target process
PID 1696 wrote to memory of 2176	1696	b8859852fde574aa9fb11a651b038f58_JaffaCakes118.exe	WerFault.exe
PID 1696 wrote to memory of 2176	1696	b8859852fde574aa9fb11a651b038f58_JaffaCakes118.exe	WerFault.exe
PID 1696 wrote to memory of 2176	1696	b8859852fde574aa9fb11a651b038f58_JaffaCakes118.exe	WerFault.exe
PID 1696 wrote to memory of 2176	1696	b8859852fde574aa9fb11a651b038f58_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b8859852fde574aa9fb11a651b038f58_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b8859852fde574aa9fb11a651b038f58_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 36
2⤵
- Program crash
PID:2176