0e6943bc99ef26618300e64f94c9f39b9bc57a42657c01859b3d70ad90fe8822

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
01/01/2025, 02:49

Target

JaffaCakes118_447c417a2846715f2efef4959857ae9b.exe
Size

102KB
MD5

447c417a2846715f2efef4959857ae9b
SHA1

3d336953335b54ef0f65d3a91d354167f2a1bf11
SHA256

0e6943bc99ef26618300e64f94c9f39b9bc57a42657c01859b3d70ad90fe8822
SHA512

01e403c847d848d7e6b2358b8e48d2e0a12f005808b12c8edd63cf779e8e8e565a94a54940c05e2b0fe252dbbf69b4d4c49787c388cace849ea0f04399101a72
SSDEEP

1536:smiehVH6s2y1ma/XReoleWg6DoWw1xz5AUvMFMQiNS8RPhk3Ri7:ziqdDNeN6DoWw1xdof8Rpk3g

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 932	2540	JaffaCakes118_447c417a2846715f2efef4959857ae9b.exe	30
PID 2540 wrote to memory of 932	2540	JaffaCakes118_447c417a2846715f2efef4959857ae9b.exe	30
PID 2540 wrote to memory of 932	2540	JaffaCakes118_447c417a2846715f2efef4959857ae9b.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_447c417a2846715f2efef4959857ae9b.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_447c417a2846715f2efef4959857ae9b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2540 -s 36
  2⤵
  PID:932