40dfbc38622a6370f6860f0dc001a99446403df5f011a5d67c08aa7e3fef130e

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 07:54

Target

042e4ebf15e124a672ad3e9595c9e345_JaffaCakes118.exe
Size

213KB
MD5

042e4ebf15e124a672ad3e9595c9e345
SHA1

b877c407e08e206ea52145545e93161d86c1bdfc
SHA256

40dfbc38622a6370f6860f0dc001a99446403df5f011a5d67c08aa7e3fef130e
SHA512

e2ada57c4f7c5eb4b443f9ea14c5337b1090e947da4bb2e1d91687130c32f337a8dcc3e0660e8e1ee4dfb10208028fca9d495b7b991fbba1d41d4980d7621df1
SSDEEP

6144:0meUqwgCJ9ipjJf6p58a9u6qWViMxj3QEdRFGRP:0meUqxCGpVfmViMx8KRFGB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2016	2232	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2016	2232	042e4ebf15e124a672ad3e9595c9e345_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2016	2232	042e4ebf15e124a672ad3e9595c9e345_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2016	2232	042e4ebf15e124a672ad3e9595c9e345_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2016	2232	042e4ebf15e124a672ad3e9595c9e345_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\042e4ebf15e124a672ad3e9595c9e345_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\042e4ebf15e124a672ad3e9595c9e345_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 84
  2⤵
  - Program crash
  PID:2016