xmrig | 2a3cd4e2381b2dd0f046156c095704ea6d0f5be59439eea2555e1914bedf1327

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 13:27

Target

6eaa9cdcdcfcf62830f3eb6296868ffa_JaffaCakes118.exe
Size

5.7MB
MD5

6eaa9cdcdcfcf62830f3eb6296868ffa
SHA1

dfe96f778fcbc95fe3d3f8092b4cdf136692e068
SHA256

2a3cd4e2381b2dd0f046156c095704ea6d0f5be59439eea2555e1914bedf1327
SHA512

4e5d9bafd9be9bd5f54c5387d77ecbd23e46bac5cc07abbd5ecf50379bc858ad3a16281aeb0ae4305c211ed0f2f729af3494eb3e2d2d1b5b958c098f8cec9483
SSDEEP

98304:hemTLkNdfE0pZaN56utgpPFotBER/mQ32lUO:w+156utgpPF8u/7O

Score

10^/10

xmrig miner

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2004-0-0x000000013FDA0000-0x00000001400ED000-memory.dmp	xmrig

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

6eaa9cdcdcfcf62830f3eb6296868ffa_JaffaCakes118.exe

description	pid	process	target process
PID 2004 wrote to memory of 2300	2004	6eaa9cdcdcfcf62830f3eb6296868ffa_JaffaCakes118.exe	WerFault.exe
PID 2004 wrote to memory of 2300	2004	6eaa9cdcdcfcf62830f3eb6296868ffa_JaffaCakes118.exe	WerFault.exe
PID 2004 wrote to memory of 2300	2004	6eaa9cdcdcfcf62830f3eb6296868ffa_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6eaa9cdcdcfcf62830f3eb6296868ffa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6eaa9cdcdcfcf62830f3eb6296868ffa_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2004 -s 72
2⤵
PID:2300

memory/2004-0-0x000000013FDA0000-0x00000001400ED000-memory.dmp

Filesize
3.3MB

Download