b3def52bf9aa11666275a77004c1cab50280129ec493734e98ce83af008b1ab7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 03:47

Target

4cb0a8f1cddeb9afddc4c1d7db104d83_JaffaCakes118.exe
Size

82KB
MD5

4cb0a8f1cddeb9afddc4c1d7db104d83
SHA1

0dc0d19701bc74ed833fcae1113758e9fe79bad0
SHA256

b3def52bf9aa11666275a77004c1cab50280129ec493734e98ce83af008b1ab7
SHA512

a676e300d08e044c129169831136f48f8f368ea859d88b7ca238d0de2e6293aad97ee099978862497b08043c5322acaeb9686fc0226cabebb98aabf773787439
SSDEEP

1536:cU4/jkbzcIFR9S9Y5RX0jmmJB+8kTd8TY3oHkyfhRg/0Wg+7NWA0BNehVRWoTIGU:C/jkbLQ2K3c8edHUXfhsV7NW/BNEVRWO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2536	2412	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2536	2412	4cb0a8f1cddeb9afddc4c1d7db104d83_JaffaCakes118.exe	30
PID 2412 wrote to memory of 2536	2412	4cb0a8f1cddeb9afddc4c1d7db104d83_JaffaCakes118.exe	30
PID 2412 wrote to memory of 2536	2412	4cb0a8f1cddeb9afddc4c1d7db104d83_JaffaCakes118.exe	30
PID 2412 wrote to memory of 2536	2412	4cb0a8f1cddeb9afddc4c1d7db104d83_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4cb0a8f1cddeb9afddc4c1d7db104d83_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4cb0a8f1cddeb9afddc4c1d7db104d83_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 88
  2⤵
  - Program crash
  PID:2536