af58541a4cb9cc60eb98e6855a319d26a17424e558add10049adf275ee4a0025

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 04:56

Target

5f19c66dc8d61db834fa749f0c08de39_JaffaCakes118.exe
Size

152KB
MD5

5f19c66dc8d61db834fa749f0c08de39
SHA1

e2d4c45b2a3155a2136d0eb546fe31351f3f7001
SHA256

af58541a4cb9cc60eb98e6855a319d26a17424e558add10049adf275ee4a0025
SHA512

bf776c29ad34916b75fa18b4171908c9e23c60f26bb820156872b55af615b91f8bef95c0a20cf2711ed34ca45de8bb94389386e275fa5f38f9eeb35ca39d99fc
SSDEEP

768:jG+VXeiIG3G7bMt3mQi4vcCpLv7P1hWKBnUaxcYnYZW:m9bMVi4vcsphWKEYnoW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2876	2720	WerFault.exe	29

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2720	5f19c66dc8d61db834fa749f0c08de39_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2876	2720	5f19c66dc8d61db834fa749f0c08de39_JaffaCakes118.exe	30
PID 2720 wrote to memory of 2876	2720	5f19c66dc8d61db834fa749f0c08de39_JaffaCakes118.exe	30
PID 2720 wrote to memory of 2876	2720	5f19c66dc8d61db834fa749f0c08de39_JaffaCakes118.exe	30
PID 2720 wrote to memory of 2876	2720	5f19c66dc8d61db834fa749f0c08de39_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\5f19c66dc8d61db834fa749f0c08de39_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5f19c66dc8d61db834fa749f0c08de39_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 188
  2⤵
  - Program crash
  PID:2876