2ee92466cf21e3e084a0b378c0c8677f5ad291300934f2ff7be4e4d7e0cc5ea7

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 18:01

Target

16f6f836b781b7f43440bde41922d57b_JaffaCakes118.exe
Size

203KB
MD5

16f6f836b781b7f43440bde41922d57b
SHA1

45e4cf6d57d089d8db653aef819b55382fd2b1b4
SHA256

2ee92466cf21e3e084a0b378c0c8677f5ad291300934f2ff7be4e4d7e0cc5ea7
SHA512

375f279435f168cb9f3d616552a544dde21c43fc8c17ba360aa0a6400f67d17f9230d8afa6b9dede5b9928279cd7666bba5981856c64a4098788a1b2eb3b9778
SSDEEP

3072:zZb2T5Hujmoi3sWLKF0Qk9jn/fi49n0JsKcD4HatTBfZMQ+pIk:db2NHu30oi9j/fb90eKcD4HatTBhMkk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2096	2060	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2096	2060	16f6f836b781b7f43440bde41922d57b_JaffaCakes118.exe	28
PID 2060 wrote to memory of 2096	2060	16f6f836b781b7f43440bde41922d57b_JaffaCakes118.exe	28
PID 2060 wrote to memory of 2096	2060	16f6f836b781b7f43440bde41922d57b_JaffaCakes118.exe	28
PID 2060 wrote to memory of 2096	2060	16f6f836b781b7f43440bde41922d57b_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\16f6f836b781b7f43440bde41922d57b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\16f6f836b781b7f43440bde41922d57b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 88
  2⤵
  - Program crash
  PID:2096