e3b32291a9801fed8f4cee4db2769fcfb1ffb55c37ef1d4c2054a345c8af598b

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 14:49

Target

16659623d288f437f6e83e4cd952a982_JaffaCakes118.exe
Size

20KB
MD5

16659623d288f437f6e83e4cd952a982
SHA1

160bef6f58bdabd04fbb8d3c9fb328708a0513e0
SHA256

e3b32291a9801fed8f4cee4db2769fcfb1ffb55c37ef1d4c2054a345c8af598b
SHA512

0dc356f98cdd01e203ffdba4724e6a4e50746a0cd030be87507d195b2834107279ea163078992ecdbe0634f6f24aa692aa74573fbca839b236f0d81aa49c897e
SSDEEP

192:D67uJCS+BZi433XuqHcUmm7hf8rc9LbFU5Vz4TdJOiM:DfYj33X1dmmdf8rcDkKLM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2956	2944	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2956	2944	16659623d288f437f6e83e4cd952a982_JaffaCakes118.exe	28
PID 2944 wrote to memory of 2956	2944	16659623d288f437f6e83e4cd952a982_JaffaCakes118.exe	28
PID 2944 wrote to memory of 2956	2944	16659623d288f437f6e83e4cd952a982_JaffaCakes118.exe	28
PID 2944 wrote to memory of 2956	2944	16659623d288f437f6e83e4cd952a982_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\16659623d288f437f6e83e4cd952a982_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\16659623d288f437f6e83e4cd952a982_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 148
  2⤵
  - Program crash
  PID:2956