e438ace2074f087978af996205ae406a920e86459b224e4b065509c8329a3329

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 09:23

Target

62addb829f64b07f90d6dd835e588f89_JaffaCakes118.exe
Size

25KB
MD5

62addb829f64b07f90d6dd835e588f89
SHA1

a5b8d117807999491448d23a5940f414e2ebe0c2
SHA256

e438ace2074f087978af996205ae406a920e86459b224e4b065509c8329a3329
SHA512

39db33fab91a73eedc734b6d9f0c83b6614f4afdc788b5ab539558ff40adc71c3920b8a893998edc2e1c1f1069df7bd04de084a3a02d2d09f7058f43eaac1cbb
SSDEEP

384:hnrZwxXTFlXaBYfgqPrlFTDOjfm5vBPUd60U3fyNeF6D2aQiTKW6X38WibG:hKxXxwBl2Rarm3UbU36YsDVOXX3ubG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1180	1488	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1180	1488	62addb829f64b07f90d6dd835e588f89_JaffaCakes118.exe	30
PID 1488 wrote to memory of 1180	1488	62addb829f64b07f90d6dd835e588f89_JaffaCakes118.exe	30
PID 1488 wrote to memory of 1180	1488	62addb829f64b07f90d6dd835e588f89_JaffaCakes118.exe	30
PID 1488 wrote to memory of 1180	1488	62addb829f64b07f90d6dd835e588f89_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\62addb829f64b07f90d6dd835e588f89_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\62addb829f64b07f90d6dd835e588f89_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 64
  2⤵
  - Program crash
  PID:1180