d6eaf523a1f21c367baa65224dae297b5ef7ce297ad57bf866b0201142d8d9f6

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/06/2024, 01:54

Target

1055142e50805fdcd7d5d034fb225bf6_JaffaCakes118.exe
Size

124KB
MD5

1055142e50805fdcd7d5d034fb225bf6
SHA1

9353ca84274e29fa3136a8c7aadbf21ea77f33d9
SHA256

d6eaf523a1f21c367baa65224dae297b5ef7ce297ad57bf866b0201142d8d9f6
SHA512

d40687a00287d1280f1b48385b88d249d24954f657fa2c3e6f4a57e7a9592973044e33ab31d1d8b6683464ade5cae60745a4006cfd44ed7f9ec058a670d6a0d4
SSDEEP

1536:oxtkj/TQCSU0GgAJa0P1kNmKldCMhdu8KWP/nTn8nBP9VeRPNeG0h/y:2kjcFU0GgAT9QIq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1872	2844	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2844	1055142e50805fdcd7d5d034fb225bf6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 1872	2844	1055142e50805fdcd7d5d034fb225bf6_JaffaCakes118.exe	28
PID 2844 wrote to memory of 1872	2844	1055142e50805fdcd7d5d034fb225bf6_JaffaCakes118.exe	28
PID 2844 wrote to memory of 1872	2844	1055142e50805fdcd7d5d034fb225bf6_JaffaCakes118.exe	28
PID 2844 wrote to memory of 1872	2844	1055142e50805fdcd7d5d034fb225bf6_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1055142e50805fdcd7d5d034fb225bf6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1055142e50805fdcd7d5d034fb225bf6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 188
  2⤵
  - Program crash
  PID:1872