3af4e28cb5edd31aad5cf408233f668dacefead303889b1bda4e6b269b8d7682

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 11:30

Target

1b2095dbb1165776af36e8beb1f4552d_JaffaCakes118.exe
Size

234KB
MD5

1b2095dbb1165776af36e8beb1f4552d
SHA1

0a8bf242d8acfa4a01920330bb3f0731431a00ef
SHA256

3af4e28cb5edd31aad5cf408233f668dacefead303889b1bda4e6b269b8d7682
SHA512

66cb508dfe589c7b530266475b7cbf92b65c81c7a8dffccb7abd916a0bd850d8dd04da9c0c077c4343315e2e651a24b6b02c3d90599d6551088492a4cf19f5fc
SSDEEP

6144:b6W5RTCPpoewOnUjJDvtVKjJV7/3txms57x1Dw:bnRT7T9vtVKT7/3tv7x1s

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2072	1548	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2072	1548	1b2095dbb1165776af36e8beb1f4552d_JaffaCakes118.exe	28
PID 1548 wrote to memory of 2072	1548	1b2095dbb1165776af36e8beb1f4552d_JaffaCakes118.exe	28
PID 1548 wrote to memory of 2072	1548	1b2095dbb1165776af36e8beb1f4552d_JaffaCakes118.exe	28
PID 1548 wrote to memory of 2072	1548	1b2095dbb1165776af36e8beb1f4552d_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1b2095dbb1165776af36e8beb1f4552d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b2095dbb1165776af36e8beb1f4552d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 68
  2⤵
  - Program crash
  PID:2072