1cd0127e4a767b33ea5a2031f1dbc23d782ec150544fc4d6b81518abd119b7fe

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 15:14

Target

2cd08167fc78d61eea2236de10145686_JaffaCakes118.exe
Size

56KB
MD5

2cd08167fc78d61eea2236de10145686
SHA1

17f7facb3ee1cdab130d64093bd13d0ee114e702
SHA256

1cd0127e4a767b33ea5a2031f1dbc23d782ec150544fc4d6b81518abd119b7fe
SHA512

5f21773810e96b733be001fbae4b5199edef1a3bd349fa4e2ba26c6eeb40891fec5d720dd07d7c75745b7c54d573b4ce27bcc8bdd63b6909d33da7e1f696657f
SSDEEP

768:6tHQl8SyipicANBNK8YhzFiEwb7sfGeh2Mz/CTUXJZYv5+tTXc:Iw2if/84cd7IR2KqcLYv5uT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1460	2528	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 1460	2528	2cd08167fc78d61eea2236de10145686_JaffaCakes118.exe	30
PID 2528 wrote to memory of 1460	2528	2cd08167fc78d61eea2236de10145686_JaffaCakes118.exe	30
PID 2528 wrote to memory of 1460	2528	2cd08167fc78d61eea2236de10145686_JaffaCakes118.exe	30
PID 2528 wrote to memory of 1460	2528	2cd08167fc78d61eea2236de10145686_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\2cd08167fc78d61eea2236de10145686_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2cd08167fc78d61eea2236de10145686_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 36
  2⤵
  - Program crash
  PID:1460