67d02abc6f3efc633e8fb0666c88ed43e70f00fb100efffccd9bd1e6e1f6607f

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 13:59

Target

06a115013358b5077a038fb5ca7eb07d_JaffaCakes118.exe
Size

164KB
MD5

06a115013358b5077a038fb5ca7eb07d
SHA1

0adf3ad72e85675133005add88e1664bf97384fe
SHA256

67d02abc6f3efc633e8fb0666c88ed43e70f00fb100efffccd9bd1e6e1f6607f
SHA512

34c3fd7fcb04eaa859658f56319422a20ebd666ddae7e1f9f7dc04415d2b562548c8098e892ea2dfe0f36cf93b1ec6b01eef13360d425a65faf0a95de4eeb3d4
SSDEEP

3072:0ETa6xaDl6KdJS0C4l1jQX3NGPkDVyoMRbd2tkU7OySUPIV7qMo:0ETa6xaMEBCK1EkPkDAQtBubNq

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\QMRTVPOW.sys	06a115013358b5077a038fb5ca7eb07d_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2576	2196	WerFault.exe	27

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

C:\Users\Admin\AppData\Local\Temp\06a115013358b5077a038fb5ca7eb07d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06a115013358b5077a038fb5ca7eb07d_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
PID:2196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 140
  2⤵
  - Program crash
  PID:2576

memory/2196-0-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2196-1-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2196-3-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2196-6-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download