8ca50f6fec7154c95a13db6df5714ccd5990568c1464b9655aa6fc9966cff021

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 18:27

Target

60f1a7cfb83cd11fab72c459856aff41_JaffaCakes118.exe
Size

280KB
MD5

60f1a7cfb83cd11fab72c459856aff41
SHA1

03c831788fcfc44e074f5b9563400916b030443a
SHA256

8ca50f6fec7154c95a13db6df5714ccd5990568c1464b9655aa6fc9966cff021
SHA512

e46e4f00b21494aa0bcfb1eafa4e188d86c61070a1cef667674fbb21117a89b859ad42e6e704fdd5e8d4cb4ab1205d21565e30c260b4cfc72fbf8985363f0d0c
SSDEEP

3072:S+ufQ8l+KmiXoIYG1AjGOgFhfshOM7RPqXbfiifM0Tl8eMi/lKAgrFMdPoMrlri:SlviIYDGdfsh17RFnyr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2964	2256	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2964	2256	60f1a7cfb83cd11fab72c459856aff41_JaffaCakes118.exe	30
PID 2256 wrote to memory of 2964	2256	60f1a7cfb83cd11fab72c459856aff41_JaffaCakes118.exe	30
PID 2256 wrote to memory of 2964	2256	60f1a7cfb83cd11fab72c459856aff41_JaffaCakes118.exe	30
PID 2256 wrote to memory of 2964	2256	60f1a7cfb83cd11fab72c459856aff41_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\60f1a7cfb83cd11fab72c459856aff41_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\60f1a7cfb83cd11fab72c459856aff41_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 196
  2⤵
  - Program crash
  PID:2964