618c89385077fc70a55d181874edc90a65df64e0fc2a5baa772cad69c4582f5c

Analysis

max time kernel
13s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 01:25

Target

6598d9b8b5fff97109f41004025d5e88_JaffaCakes118.exe
Size

284KB
MD5

6598d9b8b5fff97109f41004025d5e88
SHA1

7f985000bab253bec0680660e1b09eaf6a777c5d
SHA256

618c89385077fc70a55d181874edc90a65df64e0fc2a5baa772cad69c4582f5c
SHA512

814083ec915848e7484f225541dc18ad18e8440d952a6a90dcb6f505ad5c6a71bf03ffb149c6738f00dbff89032d324cc9aec2e3bf1f071527175ecf3fc3c1f7
SSDEEP

6144:dY71eudi4U9YHxmRws9/sEhZCw18PvP1M/CRc:iB1dhwvRL0S8Pg7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2288	1848	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2288	1848	6598d9b8b5fff97109f41004025d5e88_JaffaCakes118.exe	30
PID 1848 wrote to memory of 2288	1848	6598d9b8b5fff97109f41004025d5e88_JaffaCakes118.exe	30
PID 1848 wrote to memory of 2288	1848	6598d9b8b5fff97109f41004025d5e88_JaffaCakes118.exe	30
PID 1848 wrote to memory of 2288	1848	6598d9b8b5fff97109f41004025d5e88_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\6598d9b8b5fff97109f41004025d5e88_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6598d9b8b5fff97109f41004025d5e88_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 148
  2⤵
  - Program crash
  PID:2288