f2e55c527677aa39648142754a0311d6aa894a0256e4fb8ea40fa67fc6be3541

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 08:26

Target

0d5f84307a64a943c3bc162a4f400b14_JaffaCakes118.exe
Size

268KB
MD5

0d5f84307a64a943c3bc162a4f400b14
SHA1

8ecb11d0c2e460c675ea520357a25f119d300e67
SHA256

f2e55c527677aa39648142754a0311d6aa894a0256e4fb8ea40fa67fc6be3541
SHA512

e18b8fe7dfee4e7a4ad279c1d3c0644483d1e045365ece50ba165c9039b0c683b7faaf3b68b1de174ba41c4e926346ff4ba4b13e8e63ae9c46c16a2f236bf746
SSDEEP

6144:mBWUV+ziUcC3h8W9w4oeDee9EBas3FIxbR+d+9zY7/IKabv1mtTBg22:8WUGxQ+9EbIz1mtTk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2172	1672	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2172	1672	0d5f84307a64a943c3bc162a4f400b14_JaffaCakes118.exe	28
PID 1672 wrote to memory of 2172	1672	0d5f84307a64a943c3bc162a4f400b14_JaffaCakes118.exe	28
PID 1672 wrote to memory of 2172	1672	0d5f84307a64a943c3bc162a4f400b14_JaffaCakes118.exe	28
PID 1672 wrote to memory of 2172	1672	0d5f84307a64a943c3bc162a4f400b14_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0d5f84307a64a943c3bc162a4f400b14_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0d5f84307a64a943c3bc162a4f400b14_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 88
  2⤵
  - Program crash
  PID:2172