7544b8d1c91bb8d336c5fe866f58b9dc2a63101aa054b2b1b4c9a1a8497c41e8

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06-07-2024 21:12

Target

295f580854bb53dca0fda837f6dd8ee4_JaffaCakes118.exe
Size

16KB
MD5

295f580854bb53dca0fda837f6dd8ee4
SHA1

06401f4be1fea6468403b0c04cbe32152d6de0e3
SHA256

7544b8d1c91bb8d336c5fe866f58b9dc2a63101aa054b2b1b4c9a1a8497c41e8
SHA512

0c256ddd3dd2d9b3232f5eb987bd2056037bc21c1c67a9b424c86734803042095daba49dab6277ad1f4f7057fd5e4febb5090cf3ae123cf224c08dfc724b74b2
SSDEEP

384:gQbzgrHKtp0T9Vv4ZAPPeWuH0C4BTbWBg30/MebPuLvFP1+SFj:vbQqLu9SZYPluYnegE/R2rCSN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2524	1812	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2524	1812	295f580854bb53dca0fda837f6dd8ee4_JaffaCakes118.exe	31
PID 1812 wrote to memory of 2524	1812	295f580854bb53dca0fda837f6dd8ee4_JaffaCakes118.exe	31
PID 1812 wrote to memory of 2524	1812	295f580854bb53dca0fda837f6dd8ee4_JaffaCakes118.exe	31
PID 1812 wrote to memory of 2524	1812	295f580854bb53dca0fda837f6dd8ee4_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\295f580854bb53dca0fda837f6dd8ee4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\295f580854bb53dca0fda837f6dd8ee4_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 36
  2⤵
  - Program crash
  PID:2524