3bbfb68d78c3508fe670bc21bf3410746f7b59cf24be4758606983f61280b016

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 04:11

Target

2108fefcfda6e4fbe8798be7ffa0c009_JaffaCakes118.exe
Size

22KB
MD5

2108fefcfda6e4fbe8798be7ffa0c009
SHA1

b4288259f49a2cc71b2ee5c3e8893d4b6786182c
SHA256

3bbfb68d78c3508fe670bc21bf3410746f7b59cf24be4758606983f61280b016
SHA512

b14a4d8511c041f8b7fa0fc7baf372990d2ef9c0c9fac92897160382e0f3bec3981e05691698930c3a2d800694ffc45c7485a8a3cd382e880f958374dd222ee1
SSDEEP

384:eBDhaVkwNdbzwgLnSyOjobsldP35yoCIhZFH6sWossRoL906:eBDhij/bzwCOj4sldvXFHr9s

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2092	2516	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2092	2516	2108fefcfda6e4fbe8798be7ffa0c009_JaffaCakes118.exe	28
PID 2516 wrote to memory of 2092	2516	2108fefcfda6e4fbe8798be7ffa0c009_JaffaCakes118.exe	28
PID 2516 wrote to memory of 2092	2516	2108fefcfda6e4fbe8798be7ffa0c009_JaffaCakes118.exe	28
PID 2516 wrote to memory of 2092	2516	2108fefcfda6e4fbe8798be7ffa0c009_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\2108fefcfda6e4fbe8798be7ffa0c009_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2108fefcfda6e4fbe8798be7ffa0c009_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 144
  2⤵
  - Program crash
  PID:2092