980a19cd778a6b794cf658427e1dab5cecd2d41f77f3f6fe083dcc513f8da710

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 17:44

Target

3a23123399c45639d9c63f19d9119152_JaffaCakes118.exe
Size

27KB
MD5

3a23123399c45639d9c63f19d9119152
SHA1

202e379df5b5cb1435bfe2ac5c28a14bb6cee0af
SHA256

980a19cd778a6b794cf658427e1dab5cecd2d41f77f3f6fe083dcc513f8da710
SHA512

502eb1684a7112b5c0fdb1e359d44b3cc6ee8112db4b4226726f371e523f45297a46f4b8b759838887e47b65c591d37c951c62dd937239aa825de8919677d31c
SSDEEP

768:/UBe6/6HUnTh8CO5w2HaWfpD0a+a/XlXAuc:Mz/6HMTh3O51jN0La9Xm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2812	2712	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2812	2712	3a23123399c45639d9c63f19d9119152_JaffaCakes118.exe	30
PID 2712 wrote to memory of 2812	2712	3a23123399c45639d9c63f19d9119152_JaffaCakes118.exe	30
PID 2712 wrote to memory of 2812	2712	3a23123399c45639d9c63f19d9119152_JaffaCakes118.exe	30
PID 2712 wrote to memory of 2812	2712	3a23123399c45639d9c63f19d9119152_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3a23123399c45639d9c63f19d9119152_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a23123399c45639d9c63f19d9119152_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 92
  2⤵
  - Program crash
  PID:2812