c1e6f3149d7db2d1fbb2d41db754bdb61de385dfb131047be1c92b5934261cee

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 22:48

Target

61b84af3aaf3b15cfbcd40b78eda404c_JaffaCakes118.exe
Size

412KB
MD5

61b84af3aaf3b15cfbcd40b78eda404c
SHA1

c14430c835814a96be8473f97a9c6f69330aaaeb
SHA256

c1e6f3149d7db2d1fbb2d41db754bdb61de385dfb131047be1c92b5934261cee
SHA512

8b2604bdde4c06e71b505e3a5c5bff978a78ad77281971e8bbd6c1c404a697b87d15ed6faa4ac8bde27058de31220ff9d349c112f5cb53996928081b7c3399e4
SSDEEP

12288:6anssOPi7DYI4VkBqi+nefC3sKkkBx3Ik0nzU8J5d7D05LUSk7/r:6anssOPihBX+2CckBx4k0n/JsKSk7/r

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3060	2312	WerFault.exe	29

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2312	61b84af3aaf3b15cfbcd40b78eda404c_JaffaCakes118.exe
2312	61b84af3aaf3b15cfbcd40b78eda404c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 3060	2312	61b84af3aaf3b15cfbcd40b78eda404c_JaffaCakes118.exe	30
PID 2312 wrote to memory of 3060	2312	61b84af3aaf3b15cfbcd40b78eda404c_JaffaCakes118.exe	30
PID 2312 wrote to memory of 3060	2312	61b84af3aaf3b15cfbcd40b78eda404c_JaffaCakes118.exe	30
PID 2312 wrote to memory of 3060	2312	61b84af3aaf3b15cfbcd40b78eda404c_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\61b84af3aaf3b15cfbcd40b78eda404c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\61b84af3aaf3b15cfbcd40b78eda404c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 340
  2⤵
  - Program crash
  PID:3060

memory/2312-0-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2312-2-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2312-9-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2312-8-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2312-7-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2312-6-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2312-5-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2312-4-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2312-3-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2312-1-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2312-10-0x0000000000499000-0x000000000049A000-memory.dmp

Filesize
4KB

Download
memory/2312-12-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2312-11-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2312-13-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2312-14-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2312-15-0x0000000000499000-0x000000000049A000-memory.dmp

Filesize
4KB

Download