89c357a9b777d367dcaefaf06b41813f9ce053879532fa7a9852c09784302688

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 02:53

Target

146b7faa95ce64e2a5217f2814269a42_JaffaCakes118.exe
Size

14KB
MD5

146b7faa95ce64e2a5217f2814269a42
SHA1

52018404d427e89624f19bc980befa54e5d7662e
SHA256

89c357a9b777d367dcaefaf06b41813f9ce053879532fa7a9852c09784302688
SHA512

7062e90a5f7e5856dbe2235a4a121d51fd2597324e400ea0ec0bf6410de74d805e6ff42958716ca3e2b91cd8a405ce826d357244685570967f1baf46bbc0dc47
SSDEEP

6:4lUp/JxtHBTYk9hVudSm8tVg+pGl4SXBP3fCeFuH3Scl:VJxvrsSLo+Y46PvE3rl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	3020	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1696	3020	146b7faa95ce64e2a5217f2814269a42_JaffaCakes118.exe	28
PID 3020 wrote to memory of 1696	3020	146b7faa95ce64e2a5217f2814269a42_JaffaCakes118.exe	28
PID 3020 wrote to memory of 1696	3020	146b7faa95ce64e2a5217f2814269a42_JaffaCakes118.exe	28
PID 3020 wrote to memory of 1696	3020	146b7faa95ce64e2a5217f2814269a42_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\146b7faa95ce64e2a5217f2814269a42_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\146b7faa95ce64e2a5217f2814269a42_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 36
  2⤵
  - Program crash
  PID:1696