66a4e323bc5add1b1cbaec4a7e25d7e069983c0969fa7a327e8bd3f2d612b580

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 19:20

Target

0f3a9f24b1496c45a8d8e7b988bbf126_JaffaCakes118.exe
Size

14KB
MD5

0f3a9f24b1496c45a8d8e7b988bbf126
SHA1

0a630200c05dcad7a348e39e8ae764d60332b7dc
SHA256

66a4e323bc5add1b1cbaec4a7e25d7e069983c0969fa7a327e8bd3f2d612b580
SHA512

e75e583e775bd8127ca6b654e0f0448a5fc3d98f2a0631a4043fcc9e4a38581866b5d44e9ded10a74eeef92c374c472bbf87ea306a6be559ac08a1d15eb55fd2
SSDEEP

384:vPD6wpTMfF/WlWXacuw2prVFkW1gCcfGD:vPDDTYWEXacuw2phJww

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3012	3032	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3012	3032	0f3a9f24b1496c45a8d8e7b988bbf126_JaffaCakes118.exe	28
PID 3032 wrote to memory of 3012	3032	0f3a9f24b1496c45a8d8e7b988bbf126_JaffaCakes118.exe	28
PID 3032 wrote to memory of 3012	3032	0f3a9f24b1496c45a8d8e7b988bbf126_JaffaCakes118.exe	28
PID 3032 wrote to memory of 3012	3032	0f3a9f24b1496c45a8d8e7b988bbf126_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0f3a9f24b1496c45a8d8e7b988bbf126_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f3a9f24b1496c45a8d8e7b988bbf126_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 88
  2⤵
  - Program crash
  PID:3012