08adac97bf9e06c57f49dcb14872471c028b148d376735148dbe6c676c32d3ba

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 20:20

Target

3ec01655209890383aa71ba8d3c3c4af_JaffaCakes118.exe
Size

144KB
MD5

3ec01655209890383aa71ba8d3c3c4af
SHA1

d22a26b482ec03d3433b66b9184de08a266c2126
SHA256

08adac97bf9e06c57f49dcb14872471c028b148d376735148dbe6c676c32d3ba
SHA512

7f0ce2b77a7b252ee3c60b2cd2b9c98e89b65387562bc5bae4407e8a9f61b1c48c99ea31848f4ee8f5864ab8edf2aa5977c1729e1c4327e047d5b0849552f833
SSDEEP

1536:nq8Zv3O2ojulAL7Wm6ex9wikkRXYYnHy+pJEr7QG0GOa/Cz:rZRlAWm1w6RIEHy+6Ul4/Cz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1684	2024	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1684	2024	3ec01655209890383aa71ba8d3c3c4af_JaffaCakes118.exe	30
PID 2024 wrote to memory of 1684	2024	3ec01655209890383aa71ba8d3c3c4af_JaffaCakes118.exe	30
PID 2024 wrote to memory of 1684	2024	3ec01655209890383aa71ba8d3c3c4af_JaffaCakes118.exe	30
PID 2024 wrote to memory of 1684	2024	3ec01655209890383aa71ba8d3c3c4af_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3ec01655209890383aa71ba8d3c3c4af_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3ec01655209890383aa71ba8d3c3c4af_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 92
  2⤵
  - Program crash
  PID:1684