25232a531aea9e69a9dd5125b6d54af80693fbd05f1145ba68082d61a6672d2f

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 04:13

Target

5efc31d605c1a622294a09b9b741421f_JaffaCakes118.exe
Size

228KB
MD5

5efc31d605c1a622294a09b9b741421f
SHA1

9771b15e2e838ad7580a45e34d901a35045d4526
SHA256

25232a531aea9e69a9dd5125b6d54af80693fbd05f1145ba68082d61a6672d2f
SHA512

dfcb6b21bf80362694ec9caf6040f62ee37559784d7d172d8368a73b025ca131d62c58127af440a9c64fe31062f514dfc82ed0c7c75a5b9cd345cb8953072d71
SSDEEP

6144:b0fGDh4jLt4NVcWgyGELwXiS8T+bbhn7aRjS5ZgBbIp:EGWntWyD1LiS8lS5ZI+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2312	2272	WerFault.exe	29

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2272	5efc31d605c1a622294a09b9b741421f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2312	2272	5efc31d605c1a622294a09b9b741421f_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2312	2272	5efc31d605c1a622294a09b9b741421f_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2312	2272	5efc31d605c1a622294a09b9b741421f_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2312	2272	5efc31d605c1a622294a09b9b741421f_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\5efc31d605c1a622294a09b9b741421f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5efc31d605c1a622294a09b9b741421f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 188
  2⤵
  - Program crash
  PID:2312