0ba861c0ce7987a9ae34bd4a7d2356e04347ce031ac25ceebd425558f2e1ff32 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 01:52

Sharing

Report Analysis Logs

General

Target

01d1fe14e340028d6d52c78d9ec0113c_JaffaCakes118.exe
Size

109KB
MD5

01d1fe14e340028d6d52c78d9ec0113c
SHA1

eb4deb43b8f1543a28384df9a8d5460d435c37b5
SHA256

0ba861c0ce7987a9ae34bd4a7d2356e04347ce031ac25ceebd425558f2e1ff32
SHA512

40fc3933e81ee2ffaba749df13f1e08b8e6d8e8cef2d34031e33ed0b2722a3cac218539f420e1f16e64769191e29f5f8aadde53df92a3e8f0c96a3f065d18d4c
SSDEEP

3072:SD3Hl5JVSa4GhR+lbTlVd3c6h2o1DNoh:y3Xok+llLQoC

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	2008	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1932	2008	01d1fe14e340028d6d52c78d9ec0113c_JaffaCakes118.exe	28
PID 2008 wrote to memory of 1932	2008	01d1fe14e340028d6d52c78d9ec0113c_JaffaCakes118.exe	28
PID 2008 wrote to memory of 1932	2008	01d1fe14e340028d6d52c78d9ec0113c_JaffaCakes118.exe	28
PID 2008 wrote to memory of 1932	2008	01d1fe14e340028d6d52c78d9ec0113c_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\01d1fe14e340028d6d52c78d9ec0113c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01d1fe14e340028d6d52c78d9ec0113c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 148
  2⤵
  - Program crash
  PID:1932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads