5d048bd72cdcf0a1da7fcfac6a0a8f48fcd2376c3bc73e2fbdec1f016ecf1a44

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 09:01

Target

5b4487d966dacc7e793bd9cb4c392bec_JaffaCakes118.exe
Size

128KB
MD5

5b4487d966dacc7e793bd9cb4c392bec
SHA1

1e560d04418390b5443da4a11e301e07994bf9aa
SHA256

5d048bd72cdcf0a1da7fcfac6a0a8f48fcd2376c3bc73e2fbdec1f016ecf1a44
SHA512

04e9882660c04e179debd0d34916c1d58672178b26030bd41bfd3bd326b5970d2791f49d345fd019a171b2714885632d05c96902c2253f491c7621185053d425
SSDEEP

1536:3DTy8eESedtK6VCXuHlPrfK7YVGFnKK6OCSYUoO3Sfmun781xBwx4EcJNpI:3D7SeSMCX4AbKK4KoO3SnYrBwxsJrI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	2308	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2224	2308	5b4487d966dacc7e793bd9cb4c392bec_JaffaCakes118.exe	31
PID 2308 wrote to memory of 2224	2308	5b4487d966dacc7e793bd9cb4c392bec_JaffaCakes118.exe	31
PID 2308 wrote to memory of 2224	2308	5b4487d966dacc7e793bd9cb4c392bec_JaffaCakes118.exe	31
PID 2308 wrote to memory of 2224	2308	5b4487d966dacc7e793bd9cb4c392bec_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\5b4487d966dacc7e793bd9cb4c392bec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5b4487d966dacc7e793bd9cb4c392bec_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 36
  2⤵
  - Program crash
  PID:2224