6baf6c1331dcb951769fcc04a8d92ea280042aa9168f91880b2ad2148f0006f3

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 00:05

Target

23f2c62722a58805da4807ce7100e014_JaffaCakes118.exe
Size

78KB
MD5

23f2c62722a58805da4807ce7100e014
SHA1

8097a6282fe045e5059ba3d3bb869060c1071bcc
SHA256

6baf6c1331dcb951769fcc04a8d92ea280042aa9168f91880b2ad2148f0006f3
SHA512

09ef2d3017a18634ce1417da1a0f90a32758c0c6f9c57309ed2ed4ceed908468cdb629ef9f75dd2ffafbec1b4edecf7ca254f80ecfc5f8e8e8bae638a2f97378
SSDEEP

1536:ky5SJJIp53JPG0zNPAVrBF7/tSYwDnl5rsJ0UqRqPvp5Vwb3iomJlIK:rcg53VzNPSrRnsjrsJCSRw7iomJlIK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
836	2056	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 836	2056	23f2c62722a58805da4807ce7100e014_JaffaCakes118.exe	28
PID 2056 wrote to memory of 836	2056	23f2c62722a58805da4807ce7100e014_JaffaCakes118.exe	28
PID 2056 wrote to memory of 836	2056	23f2c62722a58805da4807ce7100e014_JaffaCakes118.exe	28
PID 2056 wrote to memory of 836	2056	23f2c62722a58805da4807ce7100e014_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\23f2c62722a58805da4807ce7100e014_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\23f2c62722a58805da4807ce7100e014_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 152
  2⤵
  - Program crash
  PID:836