27698a9b46c698f4c2c922b10c30239d02c0dc20f8edeb364483001adfd1b478

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 09:49

Target

1ad4e4eb60a3c00aaba4b6a3430cd030_JaffaCakes118.exe
Size

31KB
MD5

1ad4e4eb60a3c00aaba4b6a3430cd030
SHA1

2a60f4336c109d8c9b1272f51e347a5984744e6e
SHA256

27698a9b46c698f4c2c922b10c30239d02c0dc20f8edeb364483001adfd1b478
SHA512

5c829d57cb0ec9410e1c98bd7844ef6a537517b9d7b81ef72d2d8cd2c6aa607827e984e9e54ac5b62f8b2b2f31561c533181fa0c3afe1aeecf400ef6408eaf57
SSDEEP

768:Xj9d1IA4ZwMPIA/UCa0typsfK/oxXCi/TimpnDP5bk:T9MD/FPfyQXCirLpDP9k

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2152	1720	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2152	1720	1ad4e4eb60a3c00aaba4b6a3430cd030_JaffaCakes118.exe	29
PID 1720 wrote to memory of 2152	1720	1ad4e4eb60a3c00aaba4b6a3430cd030_JaffaCakes118.exe	29
PID 1720 wrote to memory of 2152	1720	1ad4e4eb60a3c00aaba4b6a3430cd030_JaffaCakes118.exe	29
PID 1720 wrote to memory of 2152	1720	1ad4e4eb60a3c00aaba4b6a3430cd030_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\1ad4e4eb60a3c00aaba4b6a3430cd030_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1ad4e4eb60a3c00aaba4b6a3430cd030_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 92
  2⤵
  - Program crash
  PID:2152