fffe9e227694ddd0a0eb37e749f743c22f4728748c3a7c4a5801bc793b0ed2c8

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 17:35

Target

3a1af6d42eff024b4431639239a0e47f_JaffaCakes118.exe
Size

91KB
MD5

3a1af6d42eff024b4431639239a0e47f
SHA1

6c61094724382a0898bff48b043e08685c3d972d
SHA256

fffe9e227694ddd0a0eb37e749f743c22f4728748c3a7c4a5801bc793b0ed2c8
SHA512

2fbb64fc7c509f18a36b08874049e1f3c7dc459f086b5ed313209b7d8f48fbf8a554e26e644226af6a556cdcd75f4a844366ce547cc40ab02380f23261487de8
SSDEEP

1536:KdLEO4TeqI4D/w/S8yYVDcBuuYSQMxZXB448oIO7V2TXbE59sVg0xdy7sd5:gfsewY/S8y4Qh5L58AKXbnfdywr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2356	2120	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2356	2120	3a1af6d42eff024b4431639239a0e47f_JaffaCakes118.exe	30
PID 2120 wrote to memory of 2356	2120	3a1af6d42eff024b4431639239a0e47f_JaffaCakes118.exe	30
PID 2120 wrote to memory of 2356	2120	3a1af6d42eff024b4431639239a0e47f_JaffaCakes118.exe	30
PID 2120 wrote to memory of 2356	2120	3a1af6d42eff024b4431639239a0e47f_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3a1af6d42eff024b4431639239a0e47f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a1af6d42eff024b4431639239a0e47f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 92
  2⤵
  - Program crash
  PID:2356