16016515c5a5fa8e2118547a4ea2bd71dc9ffe500013bac1f6420944f5fb99be

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06-07-2024 11:14

Target

28593995af6f566abc43d9dea32fdfd9_JaffaCakes118.exe
Size

252KB
MD5

28593995af6f566abc43d9dea32fdfd9
SHA1

e10f86b0e5e210dfcc7214fefb0f44dd99c8c95c
SHA256

16016515c5a5fa8e2118547a4ea2bd71dc9ffe500013bac1f6420944f5fb99be
SHA512

8f5af875fd54681946fdd5a433492fce8ea7e4f248cb0e4f19341f0c62476a67ece952b31248554f03f73bd8552dab77b6c284a3fef2e5d24a1c15639b6eaaf9
SSDEEP

3072:70o9AA2SGa16BrHkKW+h4lOo+151OrrjX2EflnGqkn6FawMbc/c+F/qkOL0z2m9k:7/9TvKWQgS1jSmEVzFXMby/q3Gn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2456	2604	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2456	2604	28593995af6f566abc43d9dea32fdfd9_JaffaCakes118.exe	31
PID 2604 wrote to memory of 2456	2604	28593995af6f566abc43d9dea32fdfd9_JaffaCakes118.exe	31
PID 2604 wrote to memory of 2456	2604	28593995af6f566abc43d9dea32fdfd9_JaffaCakes118.exe	31
PID 2604 wrote to memory of 2456	2604	28593995af6f566abc43d9dea32fdfd9_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\28593995af6f566abc43d9dea32fdfd9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\28593995af6f566abc43d9dea32fdfd9_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 200
  2⤵
  - Program crash
  PID:2456