12edddc38556dfe95064c7dfc53a724d8d0860146e4fd39ee8c3339a228d919a

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0844676e1a01fe4dbddaac8ee7c02fb5_JaffaCakes118.exe
Size

294KB
MD5

0844676e1a01fe4dbddaac8ee7c02fb5
SHA1

1ace3d59096f12a00d8ad43a049c8d1d40cdaab4
SHA256

12edddc38556dfe95064c7dfc53a724d8d0860146e4fd39ee8c3339a228d919a
SHA512

84db502032762b1b6f8a826f4b7212cfb2aea53424c6bfe5fc168aefe3204561a1922ca91f0bf21733fe3e5bf17b40c15597ad3a336d045ae00ab0f04cb54546
SSDEEP

6144:nsOzi5Kl8h5ei3N2M0smSX8xh9hjw+BD/5vsidxkl8dDY0StwW:nr+4YeC8xxXj5ldRDY0Stw

Score

3^/10

Malware Config

Signatures

Program crash 9 IoCs

pid	pid_target	Process	procid_target
1864	3252	WerFault.exe	80
4084	2340	WerFault.exe	82
1928	2340	WerFault.exe	82
3564	2340	WerFault.exe	82
2820	2340	WerFault.exe	82
508	2340	WerFault.exe	82
588	2340	WerFault.exe	82
1840	2340	WerFault.exe	82
3992	2340	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 2340	3252	0844676e1a01fe4dbddaac8ee7c02fb5_JaffaCakes118.exe	82
PID 3252 wrote to memory of 2340	3252	0844676e1a01fe4dbddaac8ee7c02fb5_JaffaCakes118.exe	82
PID 3252 wrote to memory of 2340	3252	0844676e1a01fe4dbddaac8ee7c02fb5_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\0844676e1a01fe4dbddaac8ee7c02fb5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0844676e1a01fe4dbddaac8ee7c02fb5_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Users\Admin\AppData\Local\Temp\0844676e1a01fe4dbddaac8ee7c02fb5_JaffaCakes118.exe
  tear
  2⤵
  PID:2340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 716
    3⤵
    - Program crash
    PID:4084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 716
    3⤵
    - Program crash
    PID:1928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 716
    3⤵
    - Program crash
    PID:3564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 772
    3⤵
    - Program crash
    PID:2820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 916
    3⤵
    - Program crash
    PID:508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 996
    3⤵
    - Program crash
    PID:588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 1036
    3⤵
    - Program crash
    PID:1840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 140
    3⤵
    - Program crash
    PID:3992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 544
  2⤵
  - Program crash
  PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3252 -ip 3252
1⤵
PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2340 -ip 2340
1⤵
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2340 -ip 2340
1⤵
PID:3780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2340 -ip 2340
1⤵
PID:3560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2340 -ip 2340
1⤵
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2340 -ip 2340
1⤵
PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2340 -ip 2340
1⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2340 -ip 2340
1⤵
PID:2004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2340 -ip 2340
1⤵
PID:4964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2340-3-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2340-4-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2340-6-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3252-0-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3252-2-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3252-1-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads