58314f0474a27b9dcf7d82620af5c213504aa088e3f0253ece9006da153518c3 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 07:32

Sharing

Report Analysis Logs

General

Target

1529e6dca6a110220f433db404f6a5dd_JaffaCakes118.exe
Size

24KB
MD5

1529e6dca6a110220f433db404f6a5dd
SHA1

2897614c3c4ed9cea2cb24769c0f6b0d41f05eb6
SHA256

58314f0474a27b9dcf7d82620af5c213504aa088e3f0253ece9006da153518c3
SHA512

a81963d5af7930a3600c42b01ce20c97cfec69fdec022387f82fa81413283d7dca6963f16b0465d3c07ba3282067f0b526e8fee3d573bbb2eaf3efd9ff18e75c
SSDEEP

768:tqh/9Q0E8gvjEMfz714IcaoHkJoZXnx9hR:wh/t6b2jXCQnzh

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2024	2100	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2024	2100	1529e6dca6a110220f433db404f6a5dd_JaffaCakes118.exe	28
PID 2100 wrote to memory of 2024	2100	1529e6dca6a110220f433db404f6a5dd_JaffaCakes118.exe	28
PID 2100 wrote to memory of 2024	2100	1529e6dca6a110220f433db404f6a5dd_JaffaCakes118.exe	28
PID 2100 wrote to memory of 2024	2100	1529e6dca6a110220f433db404f6a5dd_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1529e6dca6a110220f433db404f6a5dd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1529e6dca6a110220f433db404f6a5dd_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 88
  2⤵
  - Program crash
  PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2100-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download