4d7feed0fad78a3417fd9b2dd12d7165a8353c7a451722248587c4eb013e9f83

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 00:28

Target

477167119f838a78ec9689d38ed43bf1_JaffaCakes118.exe
Size

139KB
MD5

477167119f838a78ec9689d38ed43bf1
SHA1

37ab22f4a24fc01a95bb886b4569d986335dc012
SHA256

4d7feed0fad78a3417fd9b2dd12d7165a8353c7a451722248587c4eb013e9f83
SHA512

4c2d3ea3a199a1e81712633684ba596105756b4798148f75ae3c3238f0020809b4219010da31b96bf8794c82df0efa52a151bf5105af8a7e16c6ef0294ebc253
SSDEEP

3072:lkZvyOJzPxGq8SLsUfNCLk8p/ingM5jW5kL1uyb+nsZ6foWcAG5UP1:lk9yOx9OOwLk8xejW5Av+k6gWcPUP1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1644	2512	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1644	2512	477167119f838a78ec9689d38ed43bf1_JaffaCakes118.exe	31
PID 2512 wrote to memory of 1644	2512	477167119f838a78ec9689d38ed43bf1_JaffaCakes118.exe	31
PID 2512 wrote to memory of 1644	2512	477167119f838a78ec9689d38ed43bf1_JaffaCakes118.exe	31
PID 2512 wrote to memory of 1644	2512	477167119f838a78ec9689d38ed43bf1_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\477167119f838a78ec9689d38ed43bf1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\477167119f838a78ec9689d38ed43bf1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 92
  2⤵
  - Program crash
  PID:1644