fcff000dedb5f2bc6dd6d3294e8c800fe9cb44c0a035c53486b3bf10dac8a531

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 08:48

Target
e99b7b84fbddc2d9d5d4076a2c51c1fa_JaffaCakes118.exe
Size 154KB
Sample240409-kqlclaec8v
SHA256 fcff000dedb5f2bc6dd6d3294e8c800fe9cb44c0a035c53486b3bf10dac8a531
MD5 e99b7b84fbddc2d9d5d4076a2c51c1fa
SHA1 6e6e2eb95343776d9f6c132c55dc897fb1f312d3
SHA512 bff259dfbe59a15c8b9401f34224ded8d7ca3e2b59f9b6552eddf66144eeba71ef3f129be2d193810f7a324865f0e39b8a522e0b9efdd2842a6c6e91721181cf
SSDEEP 3072:maxBn4qgNDFLgjIQsTzuwuY18JEF0ltg+MHq1Qs/vGk1:h42sQCuG1altg+8qR9
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

agilenet

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

resource	yara_rule
behavioral1/memory/384-2-0x00000000009C0000-0x00000000009FE000-memory.dmp	agile_net

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1856	384	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 1856	384	e99b7b84fbddc2d9d5d4076a2c51c1fa_JaffaCakes118.exe	28
PID 384 wrote to memory of 1856	384	e99b7b84fbddc2d9d5d4076a2c51c1fa_JaffaCakes118.exe	28
PID 384 wrote to memory of 1856	384	e99b7b84fbddc2d9d5d4076a2c51c1fa_JaffaCakes118.exe	28
PID 384 wrote to memory of 1856	384	e99b7b84fbddc2d9d5d4076a2c51c1fa_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\e99b7b84fbddc2d9d5d4076a2c51c1fa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e99b7b84fbddc2d9d5d4076a2c51c1fa_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 588
  2⤵
  - Program crash
  PID:1856

memory/384-0-0x0000000001230000-0x000000000125C000-memory.dmp

Download

memory/384-1-0x0000000074BB0000-0x000000007529E000-memory.dmp

Download

memory/384-2-0x00000000009C0000-0x00000000009FE000-memory.dmp

Download

memory/384-3-0x0000000074BB0000-0x000000007529E000-memory.dmp

Download