99d96dd3d64766a73ccd1a763b7cb48716b21c05058ed3d275537e7db84052c2

Analysis

max time kernel
10s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 17:39

Target

31563d4f53ea82793fcea30ffc0beec7_JaffaCakes118.exe
Size

45KB
MD5

31563d4f53ea82793fcea30ffc0beec7
SHA1

e3bab9e53ed01f355015a56d11e4525e6833c659
SHA256

99d96dd3d64766a73ccd1a763b7cb48716b21c05058ed3d275537e7db84052c2
SHA512

789f0160d03ea5b64dbd4b1c3ec77597034075382d20f327a6cf5ad94fb32f937a299952f233e991f312dd05e0b82939555700379d7d1bdf0876b8784c77d6bb
SSDEEP

768:FrpsO/rHEX34xUe+ttunEHIuVyHyLiekp54Fqu05/tTm6Nhp2GSS1InEhvA3myfg:FryMz24xMG8VyGix80u0Pmcp2GSSytZd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2504	2548	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2504	2548	31563d4f53ea82793fcea30ffc0beec7_JaffaCakes118.exe	29
PID 2548 wrote to memory of 2504	2548	31563d4f53ea82793fcea30ffc0beec7_JaffaCakes118.exe	29
PID 2548 wrote to memory of 2504	2548	31563d4f53ea82793fcea30ffc0beec7_JaffaCakes118.exe	29
PID 2548 wrote to memory of 2504	2548	31563d4f53ea82793fcea30ffc0beec7_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\31563d4f53ea82793fcea30ffc0beec7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\31563d4f53ea82793fcea30ffc0beec7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 36
  2⤵
  - Program crash
  PID:2504