31659e5c98b61d421729722d2c38fce35b883b70bc473c7afe6f68c209612515

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
17/07/2024, 11:39

Target
52d02a72900b52d6e651586ec9e2a4a5_JaffaCakes118.exe
Size 322KB
Sample240717-nsa67ayerr
SHA256 31659e5c98b61d421729722d2c38fce35b883b70bc473c7afe6f68c209612515
MD5 52d02a72900b52d6e651586ec9e2a4a5
SHA1 d34dffca810cb12f5f301831dad35b56e5f3106f
SHA512 d2007f45e86d7877a22ab054bbc146bac57290548b391fc0706d94645f96cf0fb0c7ca2b009296736c030c07b195a51cf57addf6374b354a7e31ea605fb41c37
SSDEEP 6144:pVROXSLyKqSkmrROSIsZKTqWfJPaa34pCrVv5yEsT2FKRZ89K+v9:PROX0y9m4SIpBftv3DxvgEs65dl
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3108	4108	WerFault.exe	83

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4108	52d02a72900b52d6e651586ec9e2a4a5_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\52d02a72900b52d6e651586ec9e2a4a5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\52d02a72900b52d6e651586ec9e2a4a5_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 468
  2⤵
  - Program crash
  PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4108 -ip 4108
1⤵
PID:1964