15dc7da8f0d9cd3da187fa78882c2009c239e88981f5db61043c0dd63d6bed3f

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 00:05

Target

61fab3f3ea293ebad74540c31507e89f_JaffaCakes118.exe
Size

332KB
MD5

61fab3f3ea293ebad74540c31507e89f
SHA1

a6e140abd110e7eeb90c8c14ff04b9cbe123abfe
SHA256

15dc7da8f0d9cd3da187fa78882c2009c239e88981f5db61043c0dd63d6bed3f
SHA512

39d55107c06638b423dbc2cfba36c1149d1e79fc81f0ac8ed222cf2e839e1af50103dfe383f89048c6bf547ede9511d7afc93a2d87d6530e72439f12a356d730
SSDEEP

6144:20BMhwjXMwGrAswx96CIXomvyhhiAXf2N8+PAHdBZooWeJ:2uM+jcVFJyhM8uN1AHrZoRo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1384	2640	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 1384	2640	61fab3f3ea293ebad74540c31507e89f_JaffaCakes118.exe	30
PID 2640 wrote to memory of 1384	2640	61fab3f3ea293ebad74540c31507e89f_JaffaCakes118.exe	30
PID 2640 wrote to memory of 1384	2640	61fab3f3ea293ebad74540c31507e89f_JaffaCakes118.exe	30
PID 2640 wrote to memory of 1384	2640	61fab3f3ea293ebad74540c31507e89f_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\61fab3f3ea293ebad74540c31507e89f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\61fab3f3ea293ebad74540c31507e89f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 188
  2⤵
  - Program crash
  PID:1384