c5b7fcf08f86aed93e131e276c37e4740f439ebd8db97fad406f257e63a9fe62

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 07:35

Target

124f99cd528bf41de3a5d51c40359ac8_JaffaCakes118.exe
Size

248KB
MD5

124f99cd528bf41de3a5d51c40359ac8
SHA1

d2a070a7c1880beddb33351c5a5fee62324ac652
SHA256

c5b7fcf08f86aed93e131e276c37e4740f439ebd8db97fad406f257e63a9fe62
SHA512

060b8f0acc2ba721c251f886b425ebc808698b56c60fd8f9d40105e418a6cdc75c058fc82d509692535f5f200763102d54b5dad0d1d3d2b9543cf032c492cce4
SSDEEP

6144:1UQM5CElofkFWQPtnRneqAKnvmb7/D269fgwMty0e6ndv0DEQ:1S5CLkFfnRnWKnvmb7/D26qndv0DV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2176	2212	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2212	124f99cd528bf41de3a5d51c40359ac8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2176	2212	124f99cd528bf41de3a5d51c40359ac8_JaffaCakes118.exe	28
PID 2212 wrote to memory of 2176	2212	124f99cd528bf41de3a5d51c40359ac8_JaffaCakes118.exe	28
PID 2212 wrote to memory of 2176	2212	124f99cd528bf41de3a5d51c40359ac8_JaffaCakes118.exe	28
PID 2212 wrote to memory of 2176	2212	124f99cd528bf41de3a5d51c40359ac8_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\124f99cd528bf41de3a5d51c40359ac8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\124f99cd528bf41de3a5d51c40359ac8_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 188
  2⤵
  - Program crash
  PID:2176

memory/2212-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download