2204c1cdbd1f0db39fbce0f2ad041cb20ae7d8bd5b025218cf151ff50e2ea45a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 15:17

Target

22cfc9bb459f37400e937895d5994896_JaffaCakes118.exe
Size

124KB
MD5

22cfc9bb459f37400e937895d5994896
SHA1

59bd015527fc715224e932dfa37cbc5017225792
SHA256

2204c1cdbd1f0db39fbce0f2ad041cb20ae7d8bd5b025218cf151ff50e2ea45a
SHA512

e33e7b0986290b71ed4dacc7046b4008a87c23dd5414e0be3d0590bd7f0b52873186e5b337feb65effb38c3fc1c12f2e8dfeda1098bb0e9f5036aadf7a34b782
SSDEEP

1536:zLM+azMAjzsugXY3kFq+FZbU4hO8gt+jlvBR8WtBw2TVl127I42cm42mXA2J9aB1:XnazMAjzuYx8IT+jzRHtWeJ2v23o9g

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	348	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 1728	348	22cfc9bb459f37400e937895d5994896_JaffaCakes118.exe	28
PID 348 wrote to memory of 1728	348	22cfc9bb459f37400e937895d5994896_JaffaCakes118.exe	28
PID 348 wrote to memory of 1728	348	22cfc9bb459f37400e937895d5994896_JaffaCakes118.exe	28
PID 348 wrote to memory of 1728	348	22cfc9bb459f37400e937895d5994896_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\22cfc9bb459f37400e937895d5994896_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\22cfc9bb459f37400e937895d5994896_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 92
  2⤵
  - Program crash
  PID:1728