2caf2da8245c9295d1da1d1d16bcecee7a7cedd656a5d06283634c90a78f42df

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 10:59

Target

0dd09149209f11bee03f5762afc30f80_JaffaCakes118.exe
Size

3.7MB
MD5

0dd09149209f11bee03f5762afc30f80
SHA1

25dc1a97a861e59c2246d7a2edfc1f5c4af1364a
SHA256

2caf2da8245c9295d1da1d1d16bcecee7a7cedd656a5d06283634c90a78f42df
SHA512

b803fdf670ef83ce854fecb1846710069ad79e67235aa60136822a653b066d6aead23f795dd21f7ae8371cac5ec68f5e57da1418cd74e91e8b325419c2ecdbe6
SSDEEP

98304:3MN00MBQQd+py/01zQXyZuLVC3dr33UovvU9BXzqd7VP0K0:O00WQm/3BLUBkYU9dzqlKK0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
280	2288	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 280	2288	0dd09149209f11bee03f5762afc30f80_JaffaCakes118.exe	28
PID 2288 wrote to memory of 280	2288	0dd09149209f11bee03f5762afc30f80_JaffaCakes118.exe	28
PID 2288 wrote to memory of 280	2288	0dd09149209f11bee03f5762afc30f80_JaffaCakes118.exe	28
PID 2288 wrote to memory of 280	2288	0dd09149209f11bee03f5762afc30f80_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0dd09149209f11bee03f5762afc30f80_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0dd09149209f11bee03f5762afc30f80_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 180
  2⤵
  - Program crash
  PID:280