0905b236a344c4dec1f2190457f409244ebe2748161fbdf4f7d77f2f25af2b6d

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 21:32

Target

009b83d368bfc4980682aa825d9242f8_JaffaCakes118.exe
Size

60KB
MD5

009b83d368bfc4980682aa825d9242f8
SHA1

031ed703657f8c5868d074de844cf96024e2877a
SHA256

0905b236a344c4dec1f2190457f409244ebe2748161fbdf4f7d77f2f25af2b6d
SHA512

13482f6b4d1c16286dde60bc39addfa5615269d96bc05286d4e58b39a457a7e8a8b3d242f0eb111be9d9c5e162ffa59bd71b361d465674a76b927273c9473b9b
SSDEEP

768:pCUI6id3Nl++hr94Fo1PlvEsCTXjomxoCf:a6CNd9/1Pa7TTom6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2972	2912	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2972	2912	009b83d368bfc4980682aa825d9242f8_JaffaCakes118.exe	28
PID 2912 wrote to memory of 2972	2912	009b83d368bfc4980682aa825d9242f8_JaffaCakes118.exe	28
PID 2912 wrote to memory of 2972	2912	009b83d368bfc4980682aa825d9242f8_JaffaCakes118.exe	28
PID 2912 wrote to memory of 2972	2912	009b83d368bfc4980682aa825d9242f8_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\009b83d368bfc4980682aa825d9242f8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\009b83d368bfc4980682aa825d9242f8_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 136
  2⤵
  - Program crash
  PID:2972