29b27f48eb2fc762bed93f307601bc05e3ee24f30437b2c58006c0562c28ec68

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 08:59

Target

21c98261786e1e87457be789c7e9503d_JaffaCakes118.exe
Size

568KB
MD5

21c98261786e1e87457be789c7e9503d
SHA1

52cf0841dee8540d16598a1a804cc2638931de5c
SHA256

29b27f48eb2fc762bed93f307601bc05e3ee24f30437b2c58006c0562c28ec68
SHA512

5b6a54f95ec22370cf221fcd6333feaf7a5108a9c7137b46ae116a0b24d84579fc8d86bd549d98a1ce5ed7168ad8cf5742c3fca86d950b5e24d1467cddf96f53
SSDEEP

12288:xIlZYCjBMbvr892gxQMm/dHqgqT+SJroBfGiY3Dc4oofP:0K29kM2HqgqiSRoNkjP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3044	3036	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 3044	3036	21c98261786e1e87457be789c7e9503d_JaffaCakes118.exe	28
PID 3036 wrote to memory of 3044	3036	21c98261786e1e87457be789c7e9503d_JaffaCakes118.exe	28
PID 3036 wrote to memory of 3044	3036	21c98261786e1e87457be789c7e9503d_JaffaCakes118.exe	28
PID 3036 wrote to memory of 3044	3036	21c98261786e1e87457be789c7e9503d_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\21c98261786e1e87457be789c7e9503d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\21c98261786e1e87457be789c7e9503d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 120
  2⤵
  - Program crash
  PID:3044