d707807bd3a572f0305b9b0064e5ce8312946bf86d66dc862c4b350feb1d2774

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 09:00

Target

387c446a3b5c59b4ffac29cfd252dcc2_JaffaCakes118.exe
Size

226KB
MD5

387c446a3b5c59b4ffac29cfd252dcc2
SHA1

0aa3268db31e65852c1e1746b680472f1780da6e
SHA256

d707807bd3a572f0305b9b0064e5ce8312946bf86d66dc862c4b350feb1d2774
SHA512

9da669b820a0d1ffa4e429d28b1eb3c36f47e2ecfa61d1447f3fc50c6fcf04f96f6da0b4d1cbb828681f255add3a3f13ce992ff4513b3d22ae659f5786a03591
SSDEEP

3072:COZVgXp06GMKnZOXelNMJfV9AoGFsj2RkYa7CMfAkL1BDtqT+DhgkoSpRKO01U7K:GXpZpOPqV2omsxYsrJNtqTThSpsfD3n

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2748	1824	WerFault.exe	29

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1824	387c446a3b5c59b4ffac29cfd252dcc2_JaffaCakes118.exe
1824	387c446a3b5c59b4ffac29cfd252dcc2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2748	1824	387c446a3b5c59b4ffac29cfd252dcc2_JaffaCakes118.exe	30
PID 1824 wrote to memory of 2748	1824	387c446a3b5c59b4ffac29cfd252dcc2_JaffaCakes118.exe	30
PID 1824 wrote to memory of 2748	1824	387c446a3b5c59b4ffac29cfd252dcc2_JaffaCakes118.exe	30
PID 1824 wrote to memory of 2748	1824	387c446a3b5c59b4ffac29cfd252dcc2_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\387c446a3b5c59b4ffac29cfd252dcc2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\387c446a3b5c59b4ffac29cfd252dcc2_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 300
  2⤵
  - Program crash
  PID:2748

memory/1824-0-0x0000000000402000-0x000000000043A000-memory.dmp

Filesize
224KB

Download
memory/1824-1-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1824-3-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1824-2-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1824-4-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1824-5-0x0000000000402000-0x000000000043A000-memory.dmp

Filesize
224KB

Download