cea5a6c8e85b945ffcca7d22d9ea1bb1078398afd103393c63f3120bb46a7757

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 21:03

Target

5da7e342bb0311816c6e8f232a90891e_JaffaCakes118.exe
Size

38KB
MD5

5da7e342bb0311816c6e8f232a90891e
SHA1

35093d3d76c40c60b29d6742e436c251dd9e74b0
SHA256

cea5a6c8e85b945ffcca7d22d9ea1bb1078398afd103393c63f3120bb46a7757
SHA512

467500c25f7e927538e2de138b363559bb321f864171fe9e49696d5a0f97bb48fafdef4211e7aa16716401cd8fbbd29adc0f716c39923d9a6d54194acb681caf
SSDEEP

768:XN39JKRMPBFroAH5/maCJN8vje9/fks23eURXqdvOqAuo+8s8:d3f/vUAHpgjgAfUR6dvfhSs8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2108	2628	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2108	2628	5da7e342bb0311816c6e8f232a90891e_JaffaCakes118.exe	31
PID 2628 wrote to memory of 2108	2628	5da7e342bb0311816c6e8f232a90891e_JaffaCakes118.exe	31
PID 2628 wrote to memory of 2108	2628	5da7e342bb0311816c6e8f232a90891e_JaffaCakes118.exe	31
PID 2628 wrote to memory of 2108	2628	5da7e342bb0311816c6e8f232a90891e_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\5da7e342bb0311816c6e8f232a90891e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5da7e342bb0311816c6e8f232a90891e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 36
  2⤵
  - Program crash
  PID:2108

memory/2628-0-0x0000000000400000-0x000000000041D200-memory.dmp

Filesize
116KB

Download