244531686512cad332e58c5b23b22c1f4f35fb7be9fe40df6c4c7b48925b0068

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 21:07

Target

3662c2a18d85c114b0d0d44199b4aa3d_JaffaCakes118.exe
Size

512KB
MD5

3662c2a18d85c114b0d0d44199b4aa3d
SHA1

51ed758fea788ccf69c8b20e2baee6f5fc95d79d
SHA256

244531686512cad332e58c5b23b22c1f4f35fb7be9fe40df6c4c7b48925b0068
SHA512

6ea851894e50df0de6f4d119dca2828e3961638297b075542d1da4ebe4d662ba9d36fd97400e05fc6e76e8825e0e550544e2b3968fa96828572b5ac7b3744653
SSDEEP

12288:QNF8D18UJOn6A2IfV8CEYsxb6ITqfwgBBgGITZDxb1A:QQCn92eVzYqfwAEr5A

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2080 2640 WerFault.exe 3662c2a18d85c114b0d0d44199b4aa3d_JaffaCakes118.exe

pid	pid_target	process	target process
2080	2640	WerFault.exe	3662c2a18d85c114b0d0d44199b4aa3d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3662c2a18d85c114b0d0d44199b4aa3d_JaffaCakes118.exe

description	pid	process	target process
PID 2640 wrote to memory of 2080	2640	3662c2a18d85c114b0d0d44199b4aa3d_JaffaCakes118.exe	WerFault.exe
PID 2640 wrote to memory of 2080	2640	3662c2a18d85c114b0d0d44199b4aa3d_JaffaCakes118.exe	WerFault.exe
PID 2640 wrote to memory of 2080	2640	3662c2a18d85c114b0d0d44199b4aa3d_JaffaCakes118.exe	WerFault.exe
PID 2640 wrote to memory of 2080	2640	3662c2a18d85c114b0d0d44199b4aa3d_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3662c2a18d85c114b0d0d44199b4aa3d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3662c2a18d85c114b0d0d44199b4aa3d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 232
2⤵
- Program crash
PID:2080