2e50f6b0b57a3311c9c076df1f62f425f17670ddc7ed8cadc2c74a20312db220

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 15:43

Target

0963be5a621e2107a959215de36aa941_JaffaCakes118.exe
Size

93KB
MD5

0963be5a621e2107a959215de36aa941
SHA1

449373c97d669dafa0e3ee71d89f3df888e786af
SHA256

2e50f6b0b57a3311c9c076df1f62f425f17670ddc7ed8cadc2c74a20312db220
SHA512

8d869c31c67b9e841f7bc8f48e7d8e0bf3c7815751dc49ae884e30e5106c0c9c0b53440cb8af3a65610b235fef28a63f4cac08506a38cbda74ff4a09fb1ec298
SSDEEP

1536:zXyvYDRO2zmjOpBlkjM7+lujIaxixg5mzfHCtQVU9Tg4lsVPhde:zq21aTI7+lujIdOIzfCCVUNgeqZc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1892	2192	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1892	2192	0963be5a621e2107a959215de36aa941_JaffaCakes118.exe	29
PID 2192 wrote to memory of 1892	2192	0963be5a621e2107a959215de36aa941_JaffaCakes118.exe	29
PID 2192 wrote to memory of 1892	2192	0963be5a621e2107a959215de36aa941_JaffaCakes118.exe	29
PID 2192 wrote to memory of 1892	2192	0963be5a621e2107a959215de36aa941_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\0963be5a621e2107a959215de36aa941_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0963be5a621e2107a959215de36aa941_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 132
  2⤵
  - Program crash
  PID:1892

memory/2192-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download