32ef213b92e10b8bcabe8c284a37bb3940f212de1ae7e0ee8703d150fa479e36

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 09:09

Target

1991f2b57853d011a13ba3702f30bf3f_JaffaCakes118.exe
Size

8KB
MD5

1991f2b57853d011a13ba3702f30bf3f
SHA1

9d5a5fe2b2d706e96c7883721ba2f03a335a8f0a
SHA256

32ef213b92e10b8bcabe8c284a37bb3940f212de1ae7e0ee8703d150fa479e36
SHA512

7a6137303f2c71019fc8b2c322312526637385cc2d06135ffe7b056f1470ab2295d22b87fa559201ecad0422c5617c7acb72fc01f466369618273b5d3165009a
SSDEEP

96:nPy6QJeXs0H6VaY0UZylobbM9T0qsSeKTI:nBLXs0H6VaRUylnT0q9I

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2100	3020	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2100	3020	1991f2b57853d011a13ba3702f30bf3f_JaffaCakes118.exe	28
PID 3020 wrote to memory of 2100	3020	1991f2b57853d011a13ba3702f30bf3f_JaffaCakes118.exe	28
PID 3020 wrote to memory of 2100	3020	1991f2b57853d011a13ba3702f30bf3f_JaffaCakes118.exe	28
PID 3020 wrote to memory of 2100	3020	1991f2b57853d011a13ba3702f30bf3f_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1991f2b57853d011a13ba3702f30bf3f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1991f2b57853d011a13ba3702f30bf3f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 36
  2⤵
  - Program crash
  PID:2100