061c726ef923fbfe72c83968dff82910772b32a5c65d9684dc4b111ec7766516

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 20:13

Target

0aa08ce7021f950a13167728fe7386a6_JaffaCakes118.exe
Size

42KB
MD5

0aa08ce7021f950a13167728fe7386a6
SHA1

c7a0ef31c49e478532d1cc9c5de376736e3da6db
SHA256

061c726ef923fbfe72c83968dff82910772b32a5c65d9684dc4b111ec7766516
SHA512

9a03204e89ad85cdc121f865eb9564307ca301f88c9bb7ee8b4517825afc7e63c7fd04b624e7339922e9921682133d5dbb18c73d8a007d7f77274e9eaf8ca769
SSDEEP

768:wQUH43qsQB02v4ua06PnieZI2+05jswEZj3MVnWRzf5ENlrH+Z/iP7e:wQLaW5d0ixu2+CswIcFozkeZ/5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2956	2944	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2956	2944	0aa08ce7021f950a13167728fe7386a6_JaffaCakes118.exe	28
PID 2944 wrote to memory of 2956	2944	0aa08ce7021f950a13167728fe7386a6_JaffaCakes118.exe	28
PID 2944 wrote to memory of 2956	2944	0aa08ce7021f950a13167728fe7386a6_JaffaCakes118.exe	28
PID 2944 wrote to memory of 2956	2944	0aa08ce7021f950a13167728fe7386a6_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0aa08ce7021f950a13167728fe7386a6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0aa08ce7021f950a13167728fe7386a6_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 156
  2⤵
  - Program crash
  PID:2956