5bd2ab80fd3d3ce6a050061622b2e1e9269b7a64c728278e6f7fb8e3491977f9

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 00:56

Target

32b036ff208dbf3472c0145606c897bd_JaffaCakes118.exe
Size

828KB
MD5

32b036ff208dbf3472c0145606c897bd
SHA1

391b64fd465f743500738fa0b6d3b024365fa6c1
SHA256

5bd2ab80fd3d3ce6a050061622b2e1e9269b7a64c728278e6f7fb8e3491977f9
SHA512

bb1492a0ae41b3ef6fe31614e884ebaefa4098aeff49baf6bf70b9eb16f1c83c331bf8d65c714d1d37742dd0e58de1c79f8e57a7bddbd3ad911ffa581797e3ab
SSDEEP

12288:oATSjJJKymYWqlcZCgNqMCmG7HUM2SRzR3PI/4LGSJb:obeqCZCgNqMvG4/IR3PI/1C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2144	2484	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2144	2484	32b036ff208dbf3472c0145606c897bd_JaffaCakes118.exe	31
PID 2484 wrote to memory of 2144	2484	32b036ff208dbf3472c0145606c897bd_JaffaCakes118.exe	31
PID 2484 wrote to memory of 2144	2484	32b036ff208dbf3472c0145606c897bd_JaffaCakes118.exe	31
PID 2484 wrote to memory of 2144	2484	32b036ff208dbf3472c0145606c897bd_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\32b036ff208dbf3472c0145606c897bd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\32b036ff208dbf3472c0145606c897bd_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 164
  2⤵
  - Program crash
  PID:2144