9adc7dbab3f82cb2d7c27c4e76e364bf5cce570816ddbbfe4861e68e76fa05d1

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 00:52

Target

59cd98fddb6ca72cdbeed063fc815b39_JaffaCakes118.exe
Size

10KB
MD5

59cd98fddb6ca72cdbeed063fc815b39
SHA1

d143cf7f6a384884cc66a99015abf6fbf4161b9d
SHA256

9adc7dbab3f82cb2d7c27c4e76e364bf5cce570816ddbbfe4861e68e76fa05d1
SHA512

5a27cd5fee0d41ca22dcef6723deea1bc6c86a0d592b211e2473478ba10ae3421b05b9158684acd4bda3507b336b2dd19321db5d46377369445997f64b09e71a
SSDEEP

192:DDHRm5qkF4gS5iXf/kBM5b3UOuBuekHyVNhXu0f+JhA8ewkcCeSmAr+bxa4T6Ui8:Dd7b5q/kBM5b3UOuBueWyVNhXu0f+Jhk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2940	2876	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2940	2876	59cd98fddb6ca72cdbeed063fc815b39_JaffaCakes118.exe	30
PID 2876 wrote to memory of 2940	2876	59cd98fddb6ca72cdbeed063fc815b39_JaffaCakes118.exe	30
PID 2876 wrote to memory of 2940	2876	59cd98fddb6ca72cdbeed063fc815b39_JaffaCakes118.exe	30
PID 2876 wrote to memory of 2940	2876	59cd98fddb6ca72cdbeed063fc815b39_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\59cd98fddb6ca72cdbeed063fc815b39_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\59cd98fddb6ca72cdbeed063fc815b39_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 88
  2⤵
  - Program crash
  PID:2940