e91974e1567113832e0f3bb3c2e1ba4b70f3577b68dc2b0a53e2b3c5be4830ce

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 09:43

Target

6710905fc0a03b901a8255762af28a20_JaffaCakes118.exe
Size

56KB
MD5

6710905fc0a03b901a8255762af28a20
SHA1

08d4ccc9f396f56c58a8f13e7bd2794d69c31714
SHA256

e91974e1567113832e0f3bb3c2e1ba4b70f3577b68dc2b0a53e2b3c5be4830ce
SHA512

0c8555d1fa4f9b5c6a0545adc3419154c87525bfb69cdb124d24b9817619b3cbe0a76fef8f49efd6e008829f1e66d66695866f9bf3864ff5944bb30f111ee455
SSDEEP

1536:IRYlEEHl1wKtEQpRjL1yeXxXGl1TIW02vWMQR8x9QO:KAEEHcKtEwhL1TXsIW0cGRw9b

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1044	580	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 1044	580	6710905fc0a03b901a8255762af28a20_JaffaCakes118.exe	29
PID 580 wrote to memory of 1044	580	6710905fc0a03b901a8255762af28a20_JaffaCakes118.exe	29
PID 580 wrote to memory of 1044	580	6710905fc0a03b901a8255762af28a20_JaffaCakes118.exe	29
PID 580 wrote to memory of 1044	580	6710905fc0a03b901a8255762af28a20_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\6710905fc0a03b901a8255762af28a20_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6710905fc0a03b901a8255762af28a20_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 36
  2⤵
  - Program crash
  PID:1044