ad5113abbaff1e8ef676a829f41b2a596df8c3f4c2f4750b9d9a84d187dd866b

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 00:32

Target

2a5ac1a06355deddff5aabb1c4df01a9_JaffaCakes118.exe
Size

9KB
MD5

2a5ac1a06355deddff5aabb1c4df01a9
SHA1

ca89c8f0186b7867f408e7186b4ad549e6f5f917
SHA256

ad5113abbaff1e8ef676a829f41b2a596df8c3f4c2f4750b9d9a84d187dd866b
SHA512

3150d8c7bcbd5cd4395b51074f0cff021e00f922727813a31ab0a30078825f7b421a8ee68017d51470ebe26c5f63466f4c075694cb6577bfba729f6de1f50003
SSDEEP

192:bFzQrmhyOclJeB7MW3Bc9lJWn8I8BSaW:FBhyLzeB7MT9DWn8I8BBW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1996	1440	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 1996	1440	2a5ac1a06355deddff5aabb1c4df01a9_JaffaCakes118.exe	31
PID 1440 wrote to memory of 1996	1440	2a5ac1a06355deddff5aabb1c4df01a9_JaffaCakes118.exe	31
PID 1440 wrote to memory of 1996	1440	2a5ac1a06355deddff5aabb1c4df01a9_JaffaCakes118.exe	31
PID 1440 wrote to memory of 1996	1440	2a5ac1a06355deddff5aabb1c4df01a9_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\2a5ac1a06355deddff5aabb1c4df01a9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2a5ac1a06355deddff5aabb1c4df01a9_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 132
  2⤵
  - Program crash
  PID:1996