Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25-06-2024 20:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f6d1621f25fb18bf4f49d32c0210c51_JaffaCakes118.exe
Resource
win7-20240508-en
2 signatures
150 seconds
General
-
Target
0f6d1621f25fb18bf4f49d32c0210c51_JaffaCakes118.exe
-
Size
96KB
-
MD5
0f6d1621f25fb18bf4f49d32c0210c51
-
SHA1
af0d5975c2129990a2494e3f752d2d4619b1e185
-
SHA256
b95f646efcf3ddd6aa0f420ad6dd2a03b6a7074e356330bd035055f913d01af4
-
SHA512
1234a7e9f9ff5decb0077c5691a8098e02829117464bbc35a85e3e9227fe123861aabd11af13c1b7e8e9619edc082271248f7c12d45acf832e62838ae959ebf7
-
SSDEEP
1536:ajEDZ/5+uLEr4EU3xBWZCnJLCL8GV7BBk49bQVBspEzEUEoljtcVpN6CYm3kb10k:aQDFoSE0EQWZCnJLCL5QfEecVpohmQ1J
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1940 616 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 616 wrote to memory of 1940 616 0f6d1621f25fb18bf4f49d32c0210c51_JaffaCakes118.exe 28 PID 616 wrote to memory of 1940 616 0f6d1621f25fb18bf4f49d32c0210c51_JaffaCakes118.exe 28 PID 616 wrote to memory of 1940 616 0f6d1621f25fb18bf4f49d32c0210c51_JaffaCakes118.exe 28 PID 616 wrote to memory of 1940 616 0f6d1621f25fb18bf4f49d32c0210c51_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f6d1621f25fb18bf4f49d32c0210c51_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0f6d1621f25fb18bf4f49d32c0210c51_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 616 -s 1002⤵
- Program crash
PID:1940
-