71ff0bfeb5d617e7d4c4b0a268b4932e821196377aee506a28da5c81b8caa14f

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 19:15

Target

001d72c5952a76abc4565a988bd8619e_JaffaCakes118.exe
Size

16KB
MD5

001d72c5952a76abc4565a988bd8619e
SHA1

6ec0ec090303f7f141881f2e14c54b9dbf56fcba
SHA256

71ff0bfeb5d617e7d4c4b0a268b4932e821196377aee506a28da5c81b8caa14f
SHA512

fea51e998019352f23c6bfa2e9fcc4d4d3e26978138846b9d6a3d0565d79098ff2a31007968436ebd328e32a96c7734768c01b37a3ea8fbb4b049805faefb64a
SSDEEP

384:SQZQPx8/F3kmg6sP3fOvk9+ZK7DFnP7EEQZw:fZQPx8/R6nffkkkZK7DFnjENO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1900	1612	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1900	1612	001d72c5952a76abc4565a988bd8619e_JaffaCakes118.exe	28
PID 1612 wrote to memory of 1900	1612	001d72c5952a76abc4565a988bd8619e_JaffaCakes118.exe	28
PID 1612 wrote to memory of 1900	1612	001d72c5952a76abc4565a988bd8619e_JaffaCakes118.exe	28
PID 1612 wrote to memory of 1900	1612	001d72c5952a76abc4565a988bd8619e_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\001d72c5952a76abc4565a988bd8619e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\001d72c5952a76abc4565a988bd8619e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 156
  2⤵
  - Program crash
  PID:1900