6b2b092d303da67ad3f88105d945419a1b279383c49a407bcb91444e63707f84

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 15:03

Target

3ddbbfa546aadd4cd810b2e3b407dd83_JaffaCakes118.exe
Size

549KB
MD5

3ddbbfa546aadd4cd810b2e3b407dd83
SHA1

b8278ca3bb622ec2e7278a97465c22bb31520ac7
SHA256

6b2b092d303da67ad3f88105d945419a1b279383c49a407bcb91444e63707f84
SHA512

0c22bea4e435a407b1ea48921eddc78f82e8f4ce416cbbff0e147677cfb5a2ce6ddde02e146b8a672ea46b558de6717c754dd9efde173e8fc3d85591dfd8cb04
SSDEEP

12288:WJfXMWrS+wnpLG+ZHMMq1o5A2ixlxwa6VyUTMYIc08WC:WxXrrS+itG9O8xnwa6hjzWC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1500	2072	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1500	2072	3ddbbfa546aadd4cd810b2e3b407dd83_JaffaCakes118.exe	30
PID 2072 wrote to memory of 1500	2072	3ddbbfa546aadd4cd810b2e3b407dd83_JaffaCakes118.exe	30
PID 2072 wrote to memory of 1500	2072	3ddbbfa546aadd4cd810b2e3b407dd83_JaffaCakes118.exe	30
PID 2072 wrote to memory of 1500	2072	3ddbbfa546aadd4cd810b2e3b407dd83_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3ddbbfa546aadd4cd810b2e3b407dd83_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3ddbbfa546aadd4cd810b2e3b407dd83_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 136
  2⤵
  - Program crash
  PID:1500