34872545f0dd9a14ccee411db42a414a6dbaaa029db731d48a2396fc01e6617f

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 18:51

Target

17209995bd7a90cadefd84db02d8a12f_JaffaCakes118.exe
Size

156KB
MD5

17209995bd7a90cadefd84db02d8a12f
SHA1

754e592db514634216a09b9eb4d197f4097755bc
SHA256

34872545f0dd9a14ccee411db42a414a6dbaaa029db731d48a2396fc01e6617f
SHA512

68b169c2fd407e80f84ab4eb701a9a9b82df6e5b00d0eff779e323a8aba1aad62a14f43406fabe20978b18e83a454646573226ecb8a805b1396ba27802777dc6
SSDEEP

3072:s49tnC3fQTRVoKPdCHY5PZ9ymQr4tC/xfRp0UTaKgEA:ltCZ2CHY5PKd/xfRp0UTaKg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2380	2028	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2380	2028	17209995bd7a90cadefd84db02d8a12f_JaffaCakes118.exe	28
PID 2028 wrote to memory of 2380	2028	17209995bd7a90cadefd84db02d8a12f_JaffaCakes118.exe	28
PID 2028 wrote to memory of 2380	2028	17209995bd7a90cadefd84db02d8a12f_JaffaCakes118.exe	28
PID 2028 wrote to memory of 2380	2028	17209995bd7a90cadefd84db02d8a12f_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\17209995bd7a90cadefd84db02d8a12f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17209995bd7a90cadefd84db02d8a12f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 92
  2⤵
  - Program crash
  PID:2380