4c47662a7a8eba9a863df06b00edb5f7b1feb051952f4e473d89986fe8684ad1

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 22:30

Target

5df14c849efb2a91a58e5a7528cef7f8_JaffaCakes118.exe
Size

250KB
MD5

5df14c849efb2a91a58e5a7528cef7f8
SHA1

24f7e935f60d5945374de64edc8fe3a28237b075
SHA256

4c47662a7a8eba9a863df06b00edb5f7b1feb051952f4e473d89986fe8684ad1
SHA512

e77060afeb48bf016d8d7b7254f0ba2bcd35eab736e46abefdb045a3029a9775e91fe6f72f1f5949e25d12e70a9216a9dd1ac9ad4d9b12b72445d36a28420d5b
SSDEEP

6144:/Eo4DwoAAktK2oMTtZc4kX6jhDxPyu/LkSz/W:/Ee1QGtZnkX6jhD56

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
812	2140	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 812	2140	5df14c849efb2a91a58e5a7528cef7f8_JaffaCakes118.exe	30
PID 2140 wrote to memory of 812	2140	5df14c849efb2a91a58e5a7528cef7f8_JaffaCakes118.exe	30
PID 2140 wrote to memory of 812	2140	5df14c849efb2a91a58e5a7528cef7f8_JaffaCakes118.exe	30
PID 2140 wrote to memory of 812	2140	5df14c849efb2a91a58e5a7528cef7f8_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\5df14c849efb2a91a58e5a7528cef7f8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5df14c849efb2a91a58e5a7528cef7f8_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 68
  2⤵
  - Program crash
  PID:812