dfcb9e891629d3eae611d9eb19a34320141779f33183d35378cddbc1ccc79a73

Analysis

max time kernel
17s
max time network
19s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 07:45

Target

33d790544bbc241e074481a7b8f012ab_JaffaCakes118.exe
Size

544KB
MD5

33d790544bbc241e074481a7b8f012ab
SHA1

14222b527877179e6b9ddec1d31d2f5aef23a895
SHA256

dfcb9e891629d3eae611d9eb19a34320141779f33183d35378cddbc1ccc79a73
SHA512

638697a5d0d7a477a670b7750c09ed05e5fa6d7ec37012e7a5b0a70cb5cbb5e598a9b92cbf8d5d8b9c8ea62f2d6e54373edb24f711f0accdeeb7c4ab854301fb
SSDEEP

12288:gQIWT/UzJW8ivxh7vHzgryd4GT1QOoJqbbEUqe9mJd/uB28Rr8O9F8/CwM:gQI+cJHiJRTHnxhUqEhe9suB2C8O9O

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1336	2244	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2244	33d790544bbc241e074481a7b8f012ab_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1336	2244	33d790544bbc241e074481a7b8f012ab_JaffaCakes118.exe	29
PID 2244 wrote to memory of 1336	2244	33d790544bbc241e074481a7b8f012ab_JaffaCakes118.exe	29
PID 2244 wrote to memory of 1336	2244	33d790544bbc241e074481a7b8f012ab_JaffaCakes118.exe	29
PID 2244 wrote to memory of 1336	2244	33d790544bbc241e074481a7b8f012ab_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\33d790544bbc241e074481a7b8f012ab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\33d790544bbc241e074481a7b8f012ab_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 196
  2⤵
  - Program crash
  PID:1336