9ded336b84b41af6a6fd13457374477f0ba866144de74b846bf3e1c58eb62c78

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 22:00

Target

3222d26cfd5ee850fa3a9ed401d0ee9b_JaffaCakes118.exe
Size

192KB
MD5

3222d26cfd5ee850fa3a9ed401d0ee9b
SHA1

ebabe6d5835580e4648789fb6db19aee4d130517
SHA256

9ded336b84b41af6a6fd13457374477f0ba866144de74b846bf3e1c58eb62c78
SHA512

cb3ed4f6c78ae4154e7112cf6e1a19873c61facba05fa4bad29928e376473ca5cfba5ef8f67d78ae3a9caac5ade7b7f989adfa43c0e2588c4d5a0e601b58e117
SSDEEP

3072:cpzRNYuluupWyvbOijh7UAoaI52pySvl3nW0CWcscGF8ZHmt4qAb1cTqv2kgmYnK:cZRvupm9UX5WflXW5Wc88wGtckIA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3004	2996	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 3004	2996	3222d26cfd5ee850fa3a9ed401d0ee9b_JaffaCakes118.exe	30
PID 2996 wrote to memory of 3004	2996	3222d26cfd5ee850fa3a9ed401d0ee9b_JaffaCakes118.exe	30
PID 2996 wrote to memory of 3004	2996	3222d26cfd5ee850fa3a9ed401d0ee9b_JaffaCakes118.exe	30
PID 2996 wrote to memory of 3004	2996	3222d26cfd5ee850fa3a9ed401d0ee9b_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3222d26cfd5ee850fa3a9ed401d0ee9b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3222d26cfd5ee850fa3a9ed401d0ee9b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 96
  2⤵
  - Program crash
  PID:3004