9d0acc3a63c903a458ff90edd7df16c9666b5398420a7138771bf214dd12afbe

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 18:33

Target

e8225d59a252015cc4dfb8140c00b3ad_JaffaCakes118.exe
Size

24KB
MD5

e8225d59a252015cc4dfb8140c00b3ad
SHA1

f170a785b1d58e14c54c4e0a00fba705700c0e22
SHA256

9d0acc3a63c903a458ff90edd7df16c9666b5398420a7138771bf214dd12afbe
SHA512

c43380f0bfbfef7211a6002a880fb215966a81e91cdb6de28494bf7a3f025ddf1964cd2f5f6000f2ecb6ec825fe4cb980f9a25bdbf759192932d5f48aa5d59e1
SSDEEP

384:E3eVES+/xwGSRKJQ4DblM61qmTTMVF9/q5Z0:bGS+Zf1JZbO8qYoAm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2172	548	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
548	e8225d59a252015cc4dfb8140c00b3ad_JaffaCakes118.exe
548	e8225d59a252015cc4dfb8140c00b3ad_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 2172	548	e8225d59a252015cc4dfb8140c00b3ad_JaffaCakes118.exe	28
PID 548 wrote to memory of 2172	548	e8225d59a252015cc4dfb8140c00b3ad_JaffaCakes118.exe	28
PID 548 wrote to memory of 2172	548	e8225d59a252015cc4dfb8140c00b3ad_JaffaCakes118.exe	28
PID 548 wrote to memory of 2172	548	e8225d59a252015cc4dfb8140c00b3ad_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\e8225d59a252015cc4dfb8140c00b3ad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e8225d59a252015cc4dfb8140c00b3ad_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 208
  2⤵
  - Program crash
  PID:2172