fc4ee92309a76fb810ab78f3aa400c783b9bdb96ca3aad766b057e376e698a5f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
31/12/2024, 16:09

Target

JaffaCakes118_272db942a9e824017bfce23c4de7cf84.exe
Size

99KB
MD5

272db942a9e824017bfce23c4de7cf84
SHA1

b36fb2682af4a80e755b8fa9a4220b1f41093835
SHA256

fc4ee92309a76fb810ab78f3aa400c783b9bdb96ca3aad766b057e376e698a5f
SHA512

9b345cd159a3b06f2377cb5dbda6458392878b0cbd963173b1b86ed7210891464866a195d416eb7ed133a9d869df66024fbf89449744d7d964a085892a4a5c9a
SSDEEP

1536:cmiehVa6s2y1ma/XReoleWg6DoWw1xz5AUvMFMQiNS8RPhj:jiqUDNeN6DoWw1xdof8Rpj

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 1968	2092	JaffaCakes118_272db942a9e824017bfce23c4de7cf84.exe	29
PID 2092 wrote to memory of 1968	2092	JaffaCakes118_272db942a9e824017bfce23c4de7cf84.exe	29
PID 2092 wrote to memory of 1968	2092	JaffaCakes118_272db942a9e824017bfce23c4de7cf84.exe	29

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_272db942a9e824017bfce23c4de7cf84.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_272db942a9e824017bfce23c4de7cf84.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2092 -s 36
  2⤵
  PID:1968