67fd6d2a4f5ed3990511bb0c062109261224584041c3cd8a7a32996f35f4fa09

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 16:25

Target

f857d98825a568a2e7e568b126e1e973_JaffaCakes118.exe
Size

156KB
MD5

f857d98825a568a2e7e568b126e1e973
SHA1

e4039a3139ac5b3d6566f1cc359aaab6f453fb3f
SHA256

67fd6d2a4f5ed3990511bb0c062109261224584041c3cd8a7a32996f35f4fa09
SHA512

b741a2e810a32a98323776750447d2f590a6c3566f5a6ad1cbcf8176be44bd90f5f76414abd75dc0c0bfacf1c57536c2f94d151bb80abbb3ee4d5dd477554481
SSDEEP

3072:md19E2MtU7Qv0w4ZRRQMMDwtIMCeFP4AN14oQZiEhZQ:md/E2R7Qvb4tQTaCeFP4ARWTy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2416	2216	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2216	f857d98825a568a2e7e568b126e1e973_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2416	2216	f857d98825a568a2e7e568b126e1e973_JaffaCakes118.exe	28
PID 2216 wrote to memory of 2416	2216	f857d98825a568a2e7e568b126e1e973_JaffaCakes118.exe	28
PID 2216 wrote to memory of 2416	2216	f857d98825a568a2e7e568b126e1e973_JaffaCakes118.exe	28
PID 2216 wrote to memory of 2416	2216	f857d98825a568a2e7e568b126e1e973_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f857d98825a568a2e7e568b126e1e973_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f857d98825a568a2e7e568b126e1e973_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 188
  2⤵
  - Program crash
  PID:2416