72210a2a4946c0a22b890aa914015cd8d31fa638a8cc6dc1d5a697c645e569b1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 16:46

Target

3e1e0639f78507d48dd5867adb274add_JaffaCakes118.exe
Size

60KB
MD5

3e1e0639f78507d48dd5867adb274add
SHA1

4ca673ab69cd1cec9520a8d6dd6d9c40b90d912e
SHA256

72210a2a4946c0a22b890aa914015cd8d31fa638a8cc6dc1d5a697c645e569b1
SHA512

45c0a72745451a4e7397ed526fe22e36575fafe7b954f1d9d2946f87e15acfb2bcc003d88280f2c04f8f7986ec1f6126234ebc9cfa1b5a81fbbd0e7a7768b6c1
SSDEEP

768:yXPn3CSDEk/8TMGZ9gvPcZ9gvUZ9gvw/VF:yXvyMUAGZGvPcZGvUZGvcF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3068	2416	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 3068	2416	3e1e0639f78507d48dd5867adb274add_JaffaCakes118.exe	30
PID 2416 wrote to memory of 3068	2416	3e1e0639f78507d48dd5867adb274add_JaffaCakes118.exe	30
PID 2416 wrote to memory of 3068	2416	3e1e0639f78507d48dd5867adb274add_JaffaCakes118.exe	30
PID 2416 wrote to memory of 3068	2416	3e1e0639f78507d48dd5867adb274add_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3e1e0639f78507d48dd5867adb274add_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e1e0639f78507d48dd5867adb274add_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 180
  2⤵
  - Program crash
  PID:3068