2f7362c24912ae00995f29d2f2c49d14bc0f828629f30c6acc5b5c9eb3fef48e

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 20:50

Target

64c27ddb399cbb3f77bb61101ee7ba07_JaffaCakes118.exe
Size

422KB
MD5

64c27ddb399cbb3f77bb61101ee7ba07
SHA1

3e9033a758575f0f6e427f592bcb5c45d94c9a31
SHA256

2f7362c24912ae00995f29d2f2c49d14bc0f828629f30c6acc5b5c9eb3fef48e
SHA512

c790b682026c8716509c10c6e580aadfd91056f01142c5d9f121b433661af6f7ab495c0cc223b1055e8c5e8bcc084bfad77ee78bb7b8bccd5fc9236fff0b979e
SSDEEP

6144:/lXkWDUEh2g2RJx1oTYJJqe/KhzyVjPNlalzVwoDeVd+y/LhJXC1X:/dkWtjTYPqeChoj1lalh2n//S

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2564	2092	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2564	2092	64c27ddb399cbb3f77bb61101ee7ba07_JaffaCakes118.exe	30
PID 2092 wrote to memory of 2564	2092	64c27ddb399cbb3f77bb61101ee7ba07_JaffaCakes118.exe	30
PID 2092 wrote to memory of 2564	2092	64c27ddb399cbb3f77bb61101ee7ba07_JaffaCakes118.exe	30
PID 2092 wrote to memory of 2564	2092	64c27ddb399cbb3f77bb61101ee7ba07_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\64c27ddb399cbb3f77bb61101ee7ba07_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\64c27ddb399cbb3f77bb61101ee7ba07_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 48
  2⤵
  - Program crash
  PID:2564