2dcc8bf042b283e60ab10da6c6a7c03ff977b9833ebb154cd3b862bcfd25b883

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 19:06

Target

319b788430ba70cd0a4a741030b8ee8e_JaffaCakes118.exe
Size

48KB
MD5

319b788430ba70cd0a4a741030b8ee8e
SHA1

c48a1f5d9ac9235d50b3b557bcad6dbda75b1b46
SHA256

2dcc8bf042b283e60ab10da6c6a7c03ff977b9833ebb154cd3b862bcfd25b883
SHA512

14df933078da2a12f2741b664a92403e1e1524261b12a8a73ffce9ab918d2e70caa6996dc26ef88c834e5bcb4a7c4d811e2fd67234d54e0be439dc981eda169b
SSDEEP

96:vd17Si0zIp/5U1lLP/CjlO9Cv+uZYcrUV1aTa:77n0c07//CvTZrna

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1228	2512	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1228	2512	319b788430ba70cd0a4a741030b8ee8e_JaffaCakes118.exe	31
PID 2512 wrote to memory of 1228	2512	319b788430ba70cd0a4a741030b8ee8e_JaffaCakes118.exe	31
PID 2512 wrote to memory of 1228	2512	319b788430ba70cd0a4a741030b8ee8e_JaffaCakes118.exe	31
PID 2512 wrote to memory of 1228	2512	319b788430ba70cd0a4a741030b8ee8e_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\319b788430ba70cd0a4a741030b8ee8e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\319b788430ba70cd0a4a741030b8ee8e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 48
  2⤵
  - Program crash
  PID:1228