fff5e376e151572cef18e36462f5f447d9be2e832150e3abcf6d530f3e535c13

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 23:52

Target

0146d3c833a2c25614672ff6ebb6c8b3_JaffaCakes118.exe
Size

280KB
MD5

0146d3c833a2c25614672ff6ebb6c8b3
SHA1

4032928ff9351715dfb209acb3f122a6f6d7d2fb
SHA256

fff5e376e151572cef18e36462f5f447d9be2e832150e3abcf6d530f3e535c13
SHA512

ba1107bd52e3dd471ec5e56e187d3253f7ccd47b2baaf33856c79df9adf9af41c4deb1195c802959c4231a3c71109364f886f4c57121da8b38723004d493076b
SSDEEP

6144:fnIpydVsZyxyK5R8GYKi1Xfvs1tzH51t+ewSReXNU/:PuydfiebO6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1432	2240	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2240	0146d3c833a2c25614672ff6ebb6c8b3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1432	2240	0146d3c833a2c25614672ff6ebb6c8b3_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1432	2240	0146d3c833a2c25614672ff6ebb6c8b3_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1432	2240	0146d3c833a2c25614672ff6ebb6c8b3_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1432	2240	0146d3c833a2c25614672ff6ebb6c8b3_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0146d3c833a2c25614672ff6ebb6c8b3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0146d3c833a2c25614672ff6ebb6c8b3_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 188
  2⤵
  - Program crash
  PID:1432