0ff08817b2ea349f3b999ae7bbd1e7088261094d6ad56fca8d6d9381598451f0

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 21:58

Target

32212504dbe27902f628c9ef809c104f_JaffaCakes118.exe
Size

56KB
MD5

32212504dbe27902f628c9ef809c104f
SHA1

e60e08981a718208cd5c238089015310209128db
SHA256

0ff08817b2ea349f3b999ae7bbd1e7088261094d6ad56fca8d6d9381598451f0
SHA512

98be0639309f866a7190aa36e02f85b1d1258345de69639a723bead07471c153c547bca8fa5ec63fb24c0588afc0f4620f029eec826b4fcdf7e824e02a11add0
SSDEEP

1536:1vbGwMUL/IMbd+K+1F5FMRt8iLbiD3s73JxMKrgFUax:Fl6K+K+1FMmif5xxrgFnx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2504	2480	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2504	2480	32212504dbe27902f628c9ef809c104f_JaffaCakes118.exe	30
PID 2480 wrote to memory of 2504	2480	32212504dbe27902f628c9ef809c104f_JaffaCakes118.exe	30
PID 2480 wrote to memory of 2504	2480	32212504dbe27902f628c9ef809c104f_JaffaCakes118.exe	30
PID 2480 wrote to memory of 2504	2480	32212504dbe27902f628c9ef809c104f_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\32212504dbe27902f628c9ef809c104f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\32212504dbe27902f628c9ef809c104f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 36
  2⤵
  - Program crash
  PID:2504