4c9cf01b925e10f9fd346577b69c5e08e762a992abbbd99bb07bfe8e54f7f561

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 14:36 UTC

Target

352318eda58d130e0c29885de97a5639_JaffaCakes118.exe
Size

160KB
MD5

352318eda58d130e0c29885de97a5639
SHA1

ba52062bbf9baf1f40dbf06bfd49cb36ed718299
SHA256

4c9cf01b925e10f9fd346577b69c5e08e762a992abbbd99bb07bfe8e54f7f561
SHA512

07712ec038e35d15216b184d058e05f66b604d283a96ba891bc21c7f83a44b36e39c234d0aa32ec24f720b37198141453b682e179400414f01d8e1dd95409d05
SSDEEP

3072:JysG2ciAFDT/v6wBNcGbgEsSKun0f9fhY+8XqNyq6fVmXY:JyjYAFDT/3Nc7EsSKun0pt86Nm0Y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2312	1712	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2312	1712	352318eda58d130e0c29885de97a5639_JaffaCakes118.exe	30
PID 1712 wrote to memory of 2312	1712	352318eda58d130e0c29885de97a5639_JaffaCakes118.exe	30
PID 1712 wrote to memory of 2312	1712	352318eda58d130e0c29885de97a5639_JaffaCakes118.exe	30
PID 1712 wrote to memory of 2312	1712	352318eda58d130e0c29885de97a5639_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\352318eda58d130e0c29885de97a5639_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\352318eda58d130e0c29885de97a5639_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 36
  2⤵
  - Program crash
  PID:2312