0c35bb3b6be30cc21561ce344d5a910ebefca5b284d11c8f2583890c4194fe04

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 22:20

Target

0fbc9cf484a4f2d71eeb13f50f5a45a9_JaffaCakes118.exe
Size

79KB
MD5

0fbc9cf484a4f2d71eeb13f50f5a45a9
SHA1

94fe530be934c6d132c0290a98af162b6fd1d1c5
SHA256

0c35bb3b6be30cc21561ce344d5a910ebefca5b284d11c8f2583890c4194fe04
SHA512

d8de978159f2ff28255262dc2e8c7e00d07d32f066f36879afd75dc6120119ba44f27dca9228da8433033509b69bf97bb71774e87cdfe3bcd307631c96136bc2
SSDEEP

1536:D85ttZboXJ0qO/cRApm1kTYXEb8uyPG29zHW7u+yc:YFZb6J05/+ApLs0bOPG2VHW7u1c

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1144	1088	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1144	1088	0fbc9cf484a4f2d71eeb13f50f5a45a9_JaffaCakes118.exe	28
PID 1088 wrote to memory of 1144	1088	0fbc9cf484a4f2d71eeb13f50f5a45a9_JaffaCakes118.exe	28
PID 1088 wrote to memory of 1144	1088	0fbc9cf484a4f2d71eeb13f50f5a45a9_JaffaCakes118.exe	28
PID 1088 wrote to memory of 1144	1088	0fbc9cf484a4f2d71eeb13f50f5a45a9_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0fbc9cf484a4f2d71eeb13f50f5a45a9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0fbc9cf484a4f2d71eeb13f50f5a45a9_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 144
  2⤵
  - Program crash
  PID:1144