da16e2e7a02bb51ac6a7d3e26df48fab7b97201055ac9fad738d8355decb5f3c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 14:55

Target

28906dc03902561f4e81512b9709a8cd_JaffaCakes118.exe
Size

64KB
MD5

28906dc03902561f4e81512b9709a8cd
SHA1

fab41d22720bbc66a96cb5ad97026b43179e688c
SHA256

da16e2e7a02bb51ac6a7d3e26df48fab7b97201055ac9fad738d8355decb5f3c
SHA512

10ef01537eee63e9c149b14ee49eb2737d303c1c252d3eb24a869b29f1e4348e820db530b45793f755ff9188255651ccae83978afc95a54b9d186f4bfd244752
SSDEEP

1536:gpupCOqZep9g37PP92TfMw5PDSYJQJzN1c46+snQ:gopXNgLtgP5r7QJz8nPQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2756	2704	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2756	2704	28906dc03902561f4e81512b9709a8cd_JaffaCakes118.exe	30
PID 2704 wrote to memory of 2756	2704	28906dc03902561f4e81512b9709a8cd_JaffaCakes118.exe	30
PID 2704 wrote to memory of 2756	2704	28906dc03902561f4e81512b9709a8cd_JaffaCakes118.exe	30
PID 2704 wrote to memory of 2756	2704	28906dc03902561f4e81512b9709a8cd_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\28906dc03902561f4e81512b9709a8cd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\28906dc03902561f4e81512b9709a8cd_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 44
  2⤵
  - Program crash
  PID:2756