f1506fa5f9533d19be6b877b62f2699ffd08fac41ef3c1b76495eeac877d0d0b

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 21:38

Target

00a399ffa2cb91001575228ffb102559_JaffaCakes118.exe
Size

29KB
MD5

00a399ffa2cb91001575228ffb102559
SHA1

634703715922450b527102d1e75fd7214b4174f4
SHA256

f1506fa5f9533d19be6b877b62f2699ffd08fac41ef3c1b76495eeac877d0d0b
SHA512

0514e6bef9c5139943a59e3d552aa3a0f14f12e3bc40ae6b844f1be3af4d3752cb956094511c29bd11ca0a41c4e54dba5c707c7497f486c4b8b12cfb7e29c23e
SSDEEP

768:dSLzFjC3+18QDDpiyJBhlBAFkMIJe60/m8QjAHQ3y1q9F:dSFjC3g8QDNiyJBFime60/1Hx1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2688	2924	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2688	2924	00a399ffa2cb91001575228ffb102559_JaffaCakes118.exe	28
PID 2924 wrote to memory of 2688	2924	00a399ffa2cb91001575228ffb102559_JaffaCakes118.exe	28
PID 2924 wrote to memory of 2688	2924	00a399ffa2cb91001575228ffb102559_JaffaCakes118.exe	28
PID 2924 wrote to memory of 2688	2924	00a399ffa2cb91001575228ffb102559_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\00a399ffa2cb91001575228ffb102559_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00a399ffa2cb91001575228ffb102559_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 120
  2⤵
  - Program crash
  PID:2688

memory/2924-0-0x0000000000220000-0x0000000000225000-memory.dmp

Filesize
20KB

Download