f4a9fdd349c61e64c8bb84e295a167dc4156b444c3dc90b8a87d88e6523a04b1

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 05:09

Target

3c16b1024f9848beb00c210273698f8e_JaffaCakes118.exe
Size

920KB
MD5

3c16b1024f9848beb00c210273698f8e
SHA1

c602a53e5ca88810f7701507ad1f5af2ccc75ad9
SHA256

f4a9fdd349c61e64c8bb84e295a167dc4156b444c3dc90b8a87d88e6523a04b1
SHA512

305ce77589d48c431d36b3750c4083dadeb71f58a2d5750affe266afceba8eeb41e92e29359f314652b95ba3e34f7eb88caa99460896839750f41691ae1ddd72
SSDEEP

24576:TJXWAayET+QuawV+XTUknfiuG7weke8juowZKMnunK:gTzuaxjnsywKMnY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2840	3012	WerFault.exe	30

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3012	3c16b1024f9848beb00c210273698f8e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2840	3012	3c16b1024f9848beb00c210273698f8e_JaffaCakes118.exe	31
PID 3012 wrote to memory of 2840	3012	3c16b1024f9848beb00c210273698f8e_JaffaCakes118.exe	31
PID 3012 wrote to memory of 2840	3012	3c16b1024f9848beb00c210273698f8e_JaffaCakes118.exe	31
PID 3012 wrote to memory of 2840	3012	3c16b1024f9848beb00c210273698f8e_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\3c16b1024f9848beb00c210273698f8e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c16b1024f9848beb00c210273698f8e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 196
  2⤵
  - Program crash
  PID:2840