d5bc747c17b3138527c2301791ff1fab08612602c44b7d3b5141bda6f8ade7d3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 02:38

Target

2458d03eded50ff8160c3ca728ba13e2_JaffaCakes118.exe
Size

388KB
MD5

2458d03eded50ff8160c3ca728ba13e2
SHA1

790a1cd462dda176b07ac78aae60fdc009e6ba6b
SHA256

d5bc747c17b3138527c2301791ff1fab08612602c44b7d3b5141bda6f8ade7d3
SHA512

3bf6c6b4f77ab78aabec847afc3f88e824f232820bff08d81ca529a712b837c1e517da59b462f4de1ac8da7457bd5437423970960a65e878725e00ba0a592b05
SSDEEP

3072:e2voeN+jaiG17Ef5KlrKnBZ59oZSmveDlcjIV8jlwIGU+V4EFFCcll3H3rH3XD7U:ZQeNai17Y56rKnBfWhveajzxwIGU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1928	1860	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 1928	1860	2458d03eded50ff8160c3ca728ba13e2_JaffaCakes118.exe	29
PID 1860 wrote to memory of 1928	1860	2458d03eded50ff8160c3ca728ba13e2_JaffaCakes118.exe	29
PID 1860 wrote to memory of 1928	1860	2458d03eded50ff8160c3ca728ba13e2_JaffaCakes118.exe	29
PID 1860 wrote to memory of 1928	1860	2458d03eded50ff8160c3ca728ba13e2_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\2458d03eded50ff8160c3ca728ba13e2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2458d03eded50ff8160c3ca728ba13e2_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 100
  2⤵
  - Program crash
  PID:1928