842cfe9f2a3aeff35c76dd14bc7411f6f72cb9f570fadf339209f250d7c030cb

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 14:23

Target

46311e60e7525dd89f445608cdee10ec_JaffaCakes118.exe
Size

355KB
MD5

46311e60e7525dd89f445608cdee10ec
SHA1

4f2d7611535e5d0155c67c904dc456971aebc9a3
SHA256

842cfe9f2a3aeff35c76dd14bc7411f6f72cb9f570fadf339209f250d7c030cb
SHA512

9ae186a92e05fd1290c54100066c6aad93bfbc66289829f5cf9ae84fea4ee7e195b6f83fef7f763c9bee3baab365fce40903e98f264e5efefd1e89fb3cc1745a
SSDEEP

6144:4X4DtzKP8D53Z5BNYiQ7Ce9j4lS12IpIv+YAsnR8cIfSO2znhxOidz:24D1oM/NY5Z4ltIS+tz5yjZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1704	620	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1704	620	46311e60e7525dd89f445608cdee10ec_JaffaCakes118.exe	30
PID 620 wrote to memory of 1704	620	46311e60e7525dd89f445608cdee10ec_JaffaCakes118.exe	30
PID 620 wrote to memory of 1704	620	46311e60e7525dd89f445608cdee10ec_JaffaCakes118.exe	30
PID 620 wrote to memory of 1704	620	46311e60e7525dd89f445608cdee10ec_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\46311e60e7525dd89f445608cdee10ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\46311e60e7525dd89f445608cdee10ec_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 124
  2⤵
  - Program crash
  PID:1704