ad0376a81bc2ff35bbaaa02e1c8d4af1232dff0c3bd288c0264098b76057f0e6

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 19:00

Target

5d3fdc36fb89d80559ca78b39bff4dcc_JaffaCakes118.exe
Size

43KB
MD5

5d3fdc36fb89d80559ca78b39bff4dcc
SHA1

d92d87872555148422316da82809a6032ca659f5
SHA256

ad0376a81bc2ff35bbaaa02e1c8d4af1232dff0c3bd288c0264098b76057f0e6
SHA512

b7fe8bbfeecdacef96280c7cf5264cb97a12a57e5c1d02bccdbf158789cd061fb4bd1d527ee4cf376e1e3778f51f6efb80f281b76c090799b5420f6c35bcf1e1
SSDEEP

768:pzVRbuUWjvtYMAVfLmbCZflrf9cHgX/SiP3S2+xA53n:PIUGAVCwf9cA/SmCVG5n

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1724	1744	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1724	1744	5d3fdc36fb89d80559ca78b39bff4dcc_JaffaCakes118.exe	30
PID 1744 wrote to memory of 1724	1744	5d3fdc36fb89d80559ca78b39bff4dcc_JaffaCakes118.exe	30
PID 1744 wrote to memory of 1724	1744	5d3fdc36fb89d80559ca78b39bff4dcc_JaffaCakes118.exe	30
PID 1744 wrote to memory of 1724	1744	5d3fdc36fb89d80559ca78b39bff4dcc_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\5d3fdc36fb89d80559ca78b39bff4dcc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5d3fdc36fb89d80559ca78b39bff4dcc_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 88
  2⤵
  - Program crash
  PID:1724