01509dda7a32bf846d7735c53b76ef9b62ce3e9558aaf59c2fa46d20debb1236

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 09:29

Target

07b5890dc2c98d36febc31cef1d39323_JaffaCakes118.exe
Size

80KB
MD5

07b5890dc2c98d36febc31cef1d39323
SHA1

5cb867dab8cc61386c5a8b90c4ebff56a536ae7e
SHA256

01509dda7a32bf846d7735c53b76ef9b62ce3e9558aaf59c2fa46d20debb1236
SHA512

5445159834117ad782e91cf7861966f9085ab93fae2124411e054b86ff1d98f19be88210768d72078bc7b41fc860fd323f1ef5abb607c3103bb29f33f97b04ea
SSDEEP

768:fHLCJZyd0phTmOOke1/B/uBJK0KVMfsRyRFBoytfDN/SBnGHbAEUDjz:fX6yOBeZNbirbAFz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2144	1700	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1700	07b5890dc2c98d36febc31cef1d39323_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2144	1700	07b5890dc2c98d36febc31cef1d39323_JaffaCakes118.exe	29
PID 1700 wrote to memory of 2144	1700	07b5890dc2c98d36febc31cef1d39323_JaffaCakes118.exe	29
PID 1700 wrote to memory of 2144	1700	07b5890dc2c98d36febc31cef1d39323_JaffaCakes118.exe	29
PID 1700 wrote to memory of 2144	1700	07b5890dc2c98d36febc31cef1d39323_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\07b5890dc2c98d36febc31cef1d39323_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07b5890dc2c98d36febc31cef1d39323_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 244
  2⤵
  - Program crash
  PID:2144