xmrig | 44261d4744e91229ba2712da14bfe116aee40b2bd80ac0b7e0fd0eb00de8110a

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:57

Target

63b3ad73853f3d7cccf8883f8b05cbfd_JaffaCakes118.exe
Size

5.7MB
MD5

63b3ad73853f3d7cccf8883f8b05cbfd
SHA1

4b661f1be034451bfe36d00fc28ff5d32ef5746d
SHA256

44261d4744e91229ba2712da14bfe116aee40b2bd80ac0b7e0fd0eb00de8110a
SHA512

a529bea8d7e741ec85739dbc545560922999c8634feaf81f6f350a88f831a165a3a89ebb2100b39ca61a01cf8c25d6791a516e3c09baccbf593af3b01fd480d7
SSDEEP

98304:hemTLkNdfE0pZaN56utgpPFotBER/mQ32lUs:w+156utgpPF8u/7s

Score

10^/10

xmrig miner

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/1704-0-0x000000013FF90000-0x00000001402DD000-memory.dmp	xmrig

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

63b3ad73853f3d7cccf8883f8b05cbfd_JaffaCakes118.exe

description	pid	process	target process
PID 1704 wrote to memory of 2984	1704	63b3ad73853f3d7cccf8883f8b05cbfd_JaffaCakes118.exe	WerFault.exe
PID 1704 wrote to memory of 2984	1704	63b3ad73853f3d7cccf8883f8b05cbfd_JaffaCakes118.exe	WerFault.exe
PID 1704 wrote to memory of 2984	1704	63b3ad73853f3d7cccf8883f8b05cbfd_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\63b3ad73853f3d7cccf8883f8b05cbfd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63b3ad73853f3d7cccf8883f8b05cbfd_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1704 -s 72
2⤵
PID:2984

memory/1704-0-0x000000013FF90000-0x00000001402DD000-memory.dmp

Filesize
3.3MB

Download