55fbb91e5d208696a6164c6051a4873477ba9911f87388a803194d99d802d98c

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 12:02

Target

1b39a0b732e591faa09ca6978548d282_JaffaCakes118.exe
Size

57KB
MD5

1b39a0b732e591faa09ca6978548d282
SHA1

031d7a52cd37f9e6efa9072ec57275b51fe3e60d
SHA256

55fbb91e5d208696a6164c6051a4873477ba9911f87388a803194d99d802d98c
SHA512

7f4675820420c2cd2b641966ed5ac6969eda2481689a48d10abc04ac46e25af42934fac6d5da52183d42e2300f2178b1de099ed12f8f16498e1e2ff5bf4249de
SSDEEP

768:uRKc2F55e5UM0BtRxRd89dmVPwRn7ve+EQMHVQwr2nE/4QllOlYCXv/:CqQ55GBn8qVPwRn7ve+E3Qy2EQIaYC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2436	2420	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2436	2420	1b39a0b732e591faa09ca6978548d282_JaffaCakes118.exe	28
PID 2420 wrote to memory of 2436	2420	1b39a0b732e591faa09ca6978548d282_JaffaCakes118.exe	28
PID 2420 wrote to memory of 2436	2420	1b39a0b732e591faa09ca6978548d282_JaffaCakes118.exe	28
PID 2420 wrote to memory of 2436	2420	1b39a0b732e591faa09ca6978548d282_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1b39a0b732e591faa09ca6978548d282_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b39a0b732e591faa09ca6978548d282_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 88
  2⤵
  - Program crash
  PID:2436