404e93db9b450ef15cecf8f441557282fc7441e0df9c4a218921759b027baa46

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 16:13

Target

07a18d2499b2a312729934dcac503dad_JaffaCakes118.exe
Size

13KB
MD5

07a18d2499b2a312729934dcac503dad
SHA1

f4cda06ae665f8fc7b06ee1a9dee325a4e34c602
SHA256

404e93db9b450ef15cecf8f441557282fc7441e0df9c4a218921759b027baa46
SHA512

5aa1b72d98179e93f1a5a446ccde3d6d33291927989f3d62787a62601817ddada08e897e75f3675fdb5cbf1bdf273ade94f90d6ce096b3da50e4ddea5be4afa6
SSDEEP

384:FRTgH/vAv6nfjFoR2nzgqtBGXmKMX6uOgvbhAQ68O:FRTgHu6fjFoR2cYGXmKuv68O

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2264	1340	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 2264	1340	07a18d2499b2a312729934dcac503dad_JaffaCakes118.exe	28
PID 1340 wrote to memory of 2264	1340	07a18d2499b2a312729934dcac503dad_JaffaCakes118.exe	28
PID 1340 wrote to memory of 2264	1340	07a18d2499b2a312729934dcac503dad_JaffaCakes118.exe	28
PID 1340 wrote to memory of 2264	1340	07a18d2499b2a312729934dcac503dad_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\07a18d2499b2a312729934dcac503dad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07a18d2499b2a312729934dcac503dad_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 36
  2⤵
  - Program crash
  PID:2264