0f5b8655d3bf1396efc7f44515bd8c26fb449c0d127a3b2f11da9a8d4e9c2f5c

Analysis

max time kernel
142s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 07:21

Target

33c52c03f1d88ea8d7ec4107a897e616_JaffaCakes118.exe
Size

253KB
MD5

33c52c03f1d88ea8d7ec4107a897e616
SHA1

ff74c266966b9e54958edf53f9a937c9756b573f
SHA256

0f5b8655d3bf1396efc7f44515bd8c26fb449c0d127a3b2f11da9a8d4e9c2f5c
SHA512

7f537e5093173551b016fd75f0e3193456ade48ae57fb82b6b974f8adac70fe0eeed24f6a64a13428e34ba9e32e05d4cecd6dea9bc6d3eca1978edd5c76de236
SSDEEP

6144:by3yuwm+16+sc56p7MA0Ek8LcT2FCDo8QVlH2rlfrP:uWm+hsbpo3n8LcSIDQ2Jz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	2304	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 1696	2304	33c52c03f1d88ea8d7ec4107a897e616_JaffaCakes118.exe	29
PID 2304 wrote to memory of 1696	2304	33c52c03f1d88ea8d7ec4107a897e616_JaffaCakes118.exe	29
PID 2304 wrote to memory of 1696	2304	33c52c03f1d88ea8d7ec4107a897e616_JaffaCakes118.exe	29
PID 2304 wrote to memory of 1696	2304	33c52c03f1d88ea8d7ec4107a897e616_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\33c52c03f1d88ea8d7ec4107a897e616_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\33c52c03f1d88ea8d7ec4107a897e616_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 196
  2⤵
  - Program crash
  PID:1696

memory/2304-0-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download