49103e5486f07ca5aafea17536a38a3b1377c44a433e15ce9f5e6ab35fd29a1e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 06:32

Target

380e4639bdd4548e67ee8b9b27930b6a_JaffaCakes118.exe
Size

56KB
MD5

380e4639bdd4548e67ee8b9b27930b6a
SHA1

5b9e9e9c9e00b271071bcfc6c38d38dbc0de34da
SHA256

49103e5486f07ca5aafea17536a38a3b1377c44a433e15ce9f5e6ab35fd29a1e
SHA512

0bef7f00ece6bfc7d128c54ae7c1edcd8ca9c4690f79d1f11af1f757e3b405b9cabb8447c8c9a2972ced76eee0a16ddb5ef848ff2997964d8a095d6f3ecc5c20
SSDEEP

768:MJGMDRXENpxdbR2OnXSvA+iAdOMAr2d+sUnbTzL8mJuJyYlwK0/JumT:ODRXSzXWiEF02EsU3zLdJcwK0/JumT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1080	2940	WerFault.exe	30

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2940	380e4639bdd4548e67ee8b9b27930b6a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 1080	2940	380e4639bdd4548e67ee8b9b27930b6a_JaffaCakes118.exe	31
PID 2940 wrote to memory of 1080	2940	380e4639bdd4548e67ee8b9b27930b6a_JaffaCakes118.exe	31
PID 2940 wrote to memory of 1080	2940	380e4639bdd4548e67ee8b9b27930b6a_JaffaCakes118.exe	31
PID 2940 wrote to memory of 1080	2940	380e4639bdd4548e67ee8b9b27930b6a_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\380e4639bdd4548e67ee8b9b27930b6a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\380e4639bdd4548e67ee8b9b27930b6a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 188
  2⤵
  - Program crash
  PID:1080