225cf9f8c6bbfa8d05291f1e2dc0537f4b2289f7fc14687ceba14628197927d3

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 12:45

Target

306dae1e34e618b0008fa59f290f560d_JaffaCakes118.exe
Size

244KB
MD5

306dae1e34e618b0008fa59f290f560d
SHA1

8eea1f8bbb7b39388b5df662c0f429bb5edf07d8
SHA256

225cf9f8c6bbfa8d05291f1e2dc0537f4b2289f7fc14687ceba14628197927d3
SHA512

4863fd16fe5c0725352c14a0a7477bb7bc2e9f6dc13b27a151b33be56dfe89f3a17e9ff221788ff4e6eed73679678fea90be7deaf703ce66c1a0a66d7f514ef5
SSDEEP

6144:PrRww39SfGzlTphJgW9mnrQLMjTsZzILK/fObT/bGiuF0a59ONKLUWrIhO1a8p5V:6w39SfGzlTPJgWUnjjTsZzILK/fObT/O

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3020	3028	WerFault.exe	29

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3028	306dae1e34e618b0008fa59f290f560d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 3020	3028	306dae1e34e618b0008fa59f290f560d_JaffaCakes118.exe	30
PID 3028 wrote to memory of 3020	3028	306dae1e34e618b0008fa59f290f560d_JaffaCakes118.exe	30
PID 3028 wrote to memory of 3020	3028	306dae1e34e618b0008fa59f290f560d_JaffaCakes118.exe	30
PID 3028 wrote to memory of 3020	3028	306dae1e34e618b0008fa59f290f560d_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\306dae1e34e618b0008fa59f290f560d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\306dae1e34e618b0008fa59f290f560d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 188
  2⤵
  - Program crash
  PID:3020