b5fd57553f6bb0e5f9f73554932e3c59c4b856e79921f8eb15c43e3219e3fec6

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 01:45

Target

2435688342f8823757762f5793bf2f29_JaffaCakes118.exe
Size

348KB
MD5

2435688342f8823757762f5793bf2f29
SHA1

05141b29bcd0b8f150fe4747482242d535288ec9
SHA256

b5fd57553f6bb0e5f9f73554932e3c59c4b856e79921f8eb15c43e3219e3fec6
SHA512

2b4759782bc98621aad8e880cf460641259d53425673a366f54550e84dc9f3555f87747694559f4ac645ec937f73657ae9f1dd77db59bf2c2c3d51b6b769dcc7
SSDEEP

6144:MIPtkkByDz4GbDwHvDDxnixsJMfdRbwuRnH1K3ZNyTTRMNJkPX2LnXV0eOo/xObP:MeeXDzRyvDhlAdFfnH1GrMPXMnF0eOoQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2240	1452	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 2240	1452	2435688342f8823757762f5793bf2f29_JaffaCakes118.exe	28
PID 1452 wrote to memory of 2240	1452	2435688342f8823757762f5793bf2f29_JaffaCakes118.exe	28
PID 1452 wrote to memory of 2240	1452	2435688342f8823757762f5793bf2f29_JaffaCakes118.exe	28
PID 1452 wrote to memory of 2240	1452	2435688342f8823757762f5793bf2f29_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\2435688342f8823757762f5793bf2f29_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2435688342f8823757762f5793bf2f29_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 92
  2⤵
  - Program crash
  PID:2240