959d2fe1299c90a5d8d143b97e5f2fe6b62b36b0ca68c01811b6f3ee4b485fe4 | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 09:05

Sharing

Report Analysis Logs

General

Target

8033479ff159e380ed046f3d60e08286_JaffaCakes118.exe
Size

124KB
MD5

8033479ff159e380ed046f3d60e08286
SHA1

cb987967014653de48e1dd2898cb7d878c367233
SHA256

959d2fe1299c90a5d8d143b97e5f2fe6b62b36b0ca68c01811b6f3ee4b485fe4
SHA512

84561472c22d3263ae973ab436a21a20a4570714ffa2ce6f52f883d2afa14d592c0a54ee2e140f269e55d46ba1c9c6e549e99b6ddc08dc0981267abcef718b6c
SSDEEP

3072:NWJSRoWNU1GgPooZMephW1Sm7Jjgjx62:vzsGJoZTkljgR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2204	1664	8033479ff159e380ed046f3d60e08286_JaffaCakes118.exe	28
PID 1664 wrote to memory of 2204	1664	8033479ff159e380ed046f3d60e08286_JaffaCakes118.exe	28
PID 1664 wrote to memory of 2204	1664	8033479ff159e380ed046f3d60e08286_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\8033479ff159e380ed046f3d60e08286_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8033479ff159e380ed046f3d60e08286_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1664 -s 20
  2⤵
  PID:2204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads