d73e8e90a9586a9b84b540b24456c76567af4e7b601ef22e1fd357ac0571424d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06-07-2024 18:34

Target

293220f4322697bd449881bb845e1195_JaffaCakes118.exe
Size

409KB
MD5

293220f4322697bd449881bb845e1195
SHA1

55690e95583d0ab80d92c0b5cdd30494436b6d19
SHA256

d73e8e90a9586a9b84b540b24456c76567af4e7b601ef22e1fd357ac0571424d
SHA512

8bdf1193c7ea27faf8b89a707d38c3b0bb1ec0429d13ecf2b915be4ac6810387b167e9aa1e1e9a4a81dd620ac016d27db02a298571fc25478702568027a6da32
SSDEEP

6144:2xvNAHrf96nsH2B3SX213uc8XLnxkHCULbSKtiZcdqmBz7esN018A7T6KeseNl7X:2NNALfMsS13IxkvbSdiC18GKJKXY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2016	2468	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2016	2468	293220f4322697bd449881bb845e1195_JaffaCakes118.exe	28
PID 2468 wrote to memory of 2016	2468	293220f4322697bd449881bb845e1195_JaffaCakes118.exe	28
PID 2468 wrote to memory of 2016	2468	293220f4322697bd449881bb845e1195_JaffaCakes118.exe	28
PID 2468 wrote to memory of 2016	2468	293220f4322697bd449881bb845e1195_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\293220f4322697bd449881bb845e1195_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\293220f4322697bd449881bb845e1195_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 116
  2⤵
  - Program crash
  PID:2016