32cb63179cf3832325958052444ae13892a6ca43986e15e0819791581f908aea

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 08:44

Target

21bf08ceb49489b491b0b3bed0c94d1b_JaffaCakes118.exe
Size

877KB
MD5

21bf08ceb49489b491b0b3bed0c94d1b
SHA1

8f19c07fab809c73ca15ea7d4ddc1db97fb5175b
SHA256

32cb63179cf3832325958052444ae13892a6ca43986e15e0819791581f908aea
SHA512

a15ba232598b19b64531254973f9e30774ca1477149e081e954c63b7fffc917c17ef63e99986b9e2c9aeeedcf017d8ba68627e5cb4de6ae7488dc8a872c83e06
SSDEEP

24576:K93ZGZHdQLBUQ513p/ooDRSyZzG9FH6L8Y7wcYfk7u:TZHdoBUQhhZgFw8Y7wLkK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1764	1936	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1764	1936	21bf08ceb49489b491b0b3bed0c94d1b_JaffaCakes118.exe	28
PID 1936 wrote to memory of 1764	1936	21bf08ceb49489b491b0b3bed0c94d1b_JaffaCakes118.exe	28
PID 1936 wrote to memory of 1764	1936	21bf08ceb49489b491b0b3bed0c94d1b_JaffaCakes118.exe	28
PID 1936 wrote to memory of 1764	1936	21bf08ceb49489b491b0b3bed0c94d1b_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\21bf08ceb49489b491b0b3bed0c94d1b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\21bf08ceb49489b491b0b3bed0c94d1b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 92
  2⤵
  - Program crash
  PID:1764