4dd2e4e425a7ff4c82f184de56827b189ce6e188e4b4efca4151c08ab5c8af96

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 14:22

Target

4a0cad483c8d0e1dfd36bf03526872e3_JaffaCakes118.exe
Size

22KB
MD5

4a0cad483c8d0e1dfd36bf03526872e3
SHA1

3146ba34c1303c632696fcd055469f1b1942640e
SHA256

4dd2e4e425a7ff4c82f184de56827b189ce6e188e4b4efca4151c08ab5c8af96
SHA512

54ee41251a0a46049539b46ea94e05ba009d54e191226ea8ed909793b2ca06f7610f9b160cf01f1a2ac0a00e7844017ee79ab82ac9c107d60c45545202b185cc
SSDEEP

384:Vu4+1PqBYEWiS+kSPS22F/MlR4wn1fsGT:VE1PqqEWidkSPfa/SRXn1s

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1944	2388	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 1944	2388	4a0cad483c8d0e1dfd36bf03526872e3_JaffaCakes118.exe	30
PID 2388 wrote to memory of 1944	2388	4a0cad483c8d0e1dfd36bf03526872e3_JaffaCakes118.exe	30
PID 2388 wrote to memory of 1944	2388	4a0cad483c8d0e1dfd36bf03526872e3_JaffaCakes118.exe	30
PID 2388 wrote to memory of 1944	2388	4a0cad483c8d0e1dfd36bf03526872e3_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4a0cad483c8d0e1dfd36bf03526872e3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4a0cad483c8d0e1dfd36bf03526872e3_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 36
  2⤵
  - Program crash
  PID:1944