24fd18a2089a8754e7a00f5fca841bcf2182da1058a4cbe7b635f38c5e103e02

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 09:37

Target

4dbe97d13c06cbf506e0f0b8c66546f7_JaffaCakes118.exe
Size

615KB
MD5

4dbe97d13c06cbf506e0f0b8c66546f7
SHA1

cd477941e7680ad5d7a20444a0158a40a421d846
SHA256

24fd18a2089a8754e7a00f5fca841bcf2182da1058a4cbe7b635f38c5e103e02
SHA512

a0ca366cde8b61ae43565f11b7675705addfdfb122167ef2c2f2282f533301a85433bf37254c95cbeec1321c660e3e13924d4e20f1ee362edf8d323fb0a3ca67
SSDEEP

12288:/KRZNtXd62r8xrzxHp17mg/kxY96m54F05QAYf23:/KVtLr8xrNpdmCkx4HMWYf4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2512	2380	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2512	2380	4dbe97d13c06cbf506e0f0b8c66546f7_JaffaCakes118.exe	30
PID 2380 wrote to memory of 2512	2380	4dbe97d13c06cbf506e0f0b8c66546f7_JaffaCakes118.exe	30
PID 2380 wrote to memory of 2512	2380	4dbe97d13c06cbf506e0f0b8c66546f7_JaffaCakes118.exe	30
PID 2380 wrote to memory of 2512	2380	4dbe97d13c06cbf506e0f0b8c66546f7_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4dbe97d13c06cbf506e0f0b8c66546f7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4dbe97d13c06cbf506e0f0b8c66546f7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 180
  2⤵
  - Program crash
  PID:2512