fd1b3eeb0cf4a95f8e0a5697305ff56d0b71c291da12468c6766e3fc3846c93c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 19:52

Target

1c4b8d120ee30288b64849f436680ae1_JaffaCakes118.exe
Size

133KB
MD5

1c4b8d120ee30288b64849f436680ae1
SHA1

6ba0977bfe07296118bda6eed30926819eee58d1
SHA256

fd1b3eeb0cf4a95f8e0a5697305ff56d0b71c291da12468c6766e3fc3846c93c
SHA512

40d74841dc16ce4cfe74834b4bf623d83a47a3806df7350fb67655cab74443b33c1bb1822171c426412952234d44e926790f74f278ec5cf66bf30d2c7e1e2b3e
SSDEEP

3072:kx+71ajVH1Yhk1nZ5reLRHv/ZZXeLmot9sUt7t3d2:kx+7sH221n7rMRHTuyoti01d

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
328	1380	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 328	1380	1c4b8d120ee30288b64849f436680ae1_JaffaCakes118.exe	28
PID 1380 wrote to memory of 328	1380	1c4b8d120ee30288b64849f436680ae1_JaffaCakes118.exe	28
PID 1380 wrote to memory of 328	1380	1c4b8d120ee30288b64849f436680ae1_JaffaCakes118.exe	28
PID 1380 wrote to memory of 328	1380	1c4b8d120ee30288b64849f436680ae1_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1c4b8d120ee30288b64849f436680ae1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c4b8d120ee30288b64849f436680ae1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 88
  2⤵
  - Program crash
  PID:328