5041d4ac363b0fe9db54f35d3c0dd58185047c1fc7652c738c1e57ea8a390852

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 07:17

Target

07239c490c2a9dcbdcf0230d7a0ed1f0_JaffaCakes118.exe
Size

270KB
MD5

07239c490c2a9dcbdcf0230d7a0ed1f0
SHA1

4de1fae645531a299ae11aa2350b59922ce73a7f
SHA256

5041d4ac363b0fe9db54f35d3c0dd58185047c1fc7652c738c1e57ea8a390852
SHA512

0284d434614cfb61826626270d63563fc7a5be6172f6e41bfd1ae8c0fa970d58c84f651d05d7b6e8734e545059a251691adab53ed1af62d7b760d65e881a4481
SSDEEP

3072:vzBzP/dLdrKLT6aMXaaRZLC/bMjQBikVj0Yjk6iJKxdeB2jAO9WrQ:vz9b2LT8Xao5Zzejxk6iJKxdeB2MrQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2376	2960	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2376	2960	07239c490c2a9dcbdcf0230d7a0ed1f0_JaffaCakes118.exe	28
PID 2960 wrote to memory of 2376	2960	07239c490c2a9dcbdcf0230d7a0ed1f0_JaffaCakes118.exe	28
PID 2960 wrote to memory of 2376	2960	07239c490c2a9dcbdcf0230d7a0ed1f0_JaffaCakes118.exe	28
PID 2960 wrote to memory of 2376	2960	07239c490c2a9dcbdcf0230d7a0ed1f0_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\07239c490c2a9dcbdcf0230d7a0ed1f0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07239c490c2a9dcbdcf0230d7a0ed1f0_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 88
  2⤵
  - Program crash
  PID:2376