6719e439fa1f3f0d060fa09c976e73aa4f2447753075aebb73ce33fef684dec5

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 11:42

Target

5bccc06b3d2114afc578f05a60e5ae41_JaffaCakes118.exe
Size

78KB
MD5

5bccc06b3d2114afc578f05a60e5ae41
SHA1

86cfdf94e38fcbc0ec8e410211d68b0255d3fb2a
SHA256

6719e439fa1f3f0d060fa09c976e73aa4f2447753075aebb73ce33fef684dec5
SHA512

05556836d0a64ce999f4600457548d95f1f42fa3cdbf6d82c3b921fa54f85367dc3907a0963a89db036fe9d11ddd3bbde4576c5b3e8df1b878e26b3a67c5fb1b
SSDEEP

1536:wJa3L3anumj6oGiDMYPn7pYXm8gA9BT8IYWA04bxinPLZSKlNcBOD:w8enzRGiDMYP78tPTfPA04twPLZSuNcO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1760	2508	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1760	2508	5bccc06b3d2114afc578f05a60e5ae41_JaffaCakes118.exe	29
PID 2508 wrote to memory of 1760	2508	5bccc06b3d2114afc578f05a60e5ae41_JaffaCakes118.exe	29
PID 2508 wrote to memory of 1760	2508	5bccc06b3d2114afc578f05a60e5ae41_JaffaCakes118.exe	29
PID 2508 wrote to memory of 1760	2508	5bccc06b3d2114afc578f05a60e5ae41_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\5bccc06b3d2114afc578f05a60e5ae41_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5bccc06b3d2114afc578f05a60e5ae41_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 36
  2⤵
  - Program crash
  PID:1760