6f8d5ccbeae5d5fa2c2f02d7a4dcb0b544d58801c6e3c3c0c7950a18828eaa0a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 18:33

Target

4ae4f0e58fb2a2166f481695c0a53cb8_JaffaCakes118.exe
Size

188KB
MD5

4ae4f0e58fb2a2166f481695c0a53cb8
SHA1

c3e4d6b171e11311eba38e6e2fdfa792330763d2
SHA256

6f8d5ccbeae5d5fa2c2f02d7a4dcb0b544d58801c6e3c3c0c7950a18828eaa0a
SHA512

20dabf4f0cbeddf5317afc6daf4ba9674f5e8cee5f0558f229d849190218bc57b7f1d7fb33906e1718f79594007195c75e6fa258b7481026b15160b858329030
SSDEEP

3072:Tfyq+55ROnF9Wj5pY0hrDGILpLI0M/Dk4KrfXRdjnbk9bOlezfQnFTTvprw1W/Sg:T6q+CWdCKs0tzXRdjbk9bbyvprwwwOj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2308	2148	WerFault.exe	29

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2148	4ae4f0e58fb2a2166f481695c0a53cb8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2308	2148	4ae4f0e58fb2a2166f481695c0a53cb8_JaffaCakes118.exe	30
PID 2148 wrote to memory of 2308	2148	4ae4f0e58fb2a2166f481695c0a53cb8_JaffaCakes118.exe	30
PID 2148 wrote to memory of 2308	2148	4ae4f0e58fb2a2166f481695c0a53cb8_JaffaCakes118.exe	30
PID 2148 wrote to memory of 2308	2148	4ae4f0e58fb2a2166f481695c0a53cb8_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4ae4f0e58fb2a2166f481695c0a53cb8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4ae4f0e58fb2a2166f481695c0a53cb8_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 188
  2⤵
  - Program crash
  PID:2308