d4ca2e10aee9f1b5fbf041844a07000e9c6d4d1661e0d3a8abd2a3b54ba13eb3

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 04:44

Target

403f221b666ad8349f42919a82b829f1_JaffaCakes118.exe
Size

36KB
MD5

403f221b666ad8349f42919a82b829f1
SHA1

c97a7331017d4bfa25819894dfa106a96126ec9b
SHA256

d4ca2e10aee9f1b5fbf041844a07000e9c6d4d1661e0d3a8abd2a3b54ba13eb3
SHA512

029dbfe968c9991749199612f8af6f655e2aa303f96633b0404cd2154aff5bbf9bedd2e1632aa7673f8b4437f408a506b094e1377808482aecfe36f1f5acc798
SSDEEP

384:UG7lLLf8pA3gaIfgJexct3bfTsGXgywshs02excA1G9WUtaEe/DN/Yr:/J8rgoIDwGbwR02eaAweLNY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2704	2668	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2704	2668	403f221b666ad8349f42919a82b829f1_JaffaCakes118.exe	30
PID 2668 wrote to memory of 2704	2668	403f221b666ad8349f42919a82b829f1_JaffaCakes118.exe	30
PID 2668 wrote to memory of 2704	2668	403f221b666ad8349f42919a82b829f1_JaffaCakes118.exe	30
PID 2668 wrote to memory of 2704	2668	403f221b666ad8349f42919a82b829f1_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\403f221b666ad8349f42919a82b829f1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\403f221b666ad8349f42919a82b829f1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 148
  2⤵
  - Program crash
  PID:2704