Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 20:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
367591ceecc09e026e12145cea35eb47_JaffaCakes118.exe
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
367591ceecc09e026e12145cea35eb47_JaffaCakes118.exe
Resource
win10v2004-20240508-en
0 signatures
150 seconds
General
-
Target
367591ceecc09e026e12145cea35eb47_JaffaCakes118.exe
-
Size
189KB
-
MD5
367591ceecc09e026e12145cea35eb47
-
SHA1
a082499833e84de12868ff267d164ff42d41db52
-
SHA256
b999a8d860a081a07c5ff459d47c76a82eefc5e2e7d88b7588e8f158e561570f
-
SHA512
e2e6850ce2d1ad59b17ac28a7706a8c722ffeb11fdbfe31ba50ffeee3d82a2d7b6c11bfd8824ecb85b2ad2d32b0c84077d52eee704429a23d0bf1cdd20b6c1ff
-
SSDEEP
3072:o84ycFrH4l06fWnxNxvADObX95mayxkwsBeApMSwPRksJLkyDEwHkFWloAm2A8fD:H4tLlHaDO73kxkwsBeQMSWksieRkAKlw
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2008 2304 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2008 2304 367591ceecc09e026e12145cea35eb47_JaffaCakes118.exe 28 PID 2304 wrote to memory of 2008 2304 367591ceecc09e026e12145cea35eb47_JaffaCakes118.exe 28 PID 2304 wrote to memory of 2008 2304 367591ceecc09e026e12145cea35eb47_JaffaCakes118.exe 28 PID 2304 wrote to memory of 2008 2304 367591ceecc09e026e12145cea35eb47_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\367591ceecc09e026e12145cea35eb47_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\367591ceecc09e026e12145cea35eb47_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 922⤵
- Program crash
PID:2008
-