55c0f6279f5239308110cc73a8f98bcd74de685d652682c4c28284a3a2734ded

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 23:05

Target

472b41803b23f64fef5ca0aa38fd929a_JaffaCakes118.exe
Size

269KB
MD5

472b41803b23f64fef5ca0aa38fd929a
SHA1

a32a88117cdce5860ac289cab5f7cb8a47b30df3
SHA256

55c0f6279f5239308110cc73a8f98bcd74de685d652682c4c28284a3a2734ded
SHA512

aad016eb054fb15379c7a7be3af35d96a683841edafaded02aec29268a05097a544af02df6fcc3cc1467b7a23abf5e274dad55de833a2b57b26fc199cc52d3a6
SSDEEP

6144:qBWUV+ziUcC3h8W9w4oeDee9EBas3FIxbR+d+9zY7/IKabv1mtTBS2t:4WUGxQ+9EbIz1mtTZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2344	2660	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2344	2660	472b41803b23f64fef5ca0aa38fd929a_JaffaCakes118.exe	30
PID 2660 wrote to memory of 2344	2660	472b41803b23f64fef5ca0aa38fd929a_JaffaCakes118.exe	30
PID 2660 wrote to memory of 2344	2660	472b41803b23f64fef5ca0aa38fd929a_JaffaCakes118.exe	30
PID 2660 wrote to memory of 2344	2660	472b41803b23f64fef5ca0aa38fd929a_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\472b41803b23f64fef5ca0aa38fd929a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\472b41803b23f64fef5ca0aa38fd929a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 88
  2⤵
  - Program crash
  PID:2344