19a4f7b095c897a44c6d27e7d37b9ae941e13974125a84681f0870f75839a43a | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 12:18

Sharing

Report Analysis Logs

General

Target

15fb185faa29e07681b92fe74a20e749_JaffaCakes118.exe
Size

4KB
MD5

15fb185faa29e07681b92fe74a20e749
SHA1

ebb516fc63fb84c84b1c1ad3a27a9a6b642f8268
SHA256

19a4f7b095c897a44c6d27e7d37b9ae941e13974125a84681f0870f75839a43a
SHA512

09e3220cbadaec1519572dfff39d3a86f4e624cf85cb51488fe5c98defe4d23b444987f1569615854ec4b2a2ab9d80d5bd75fcc627da7f02581176f1720df3c9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3060	1992	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 3060	1992	15fb185faa29e07681b92fe74a20e749_JaffaCakes118.exe	28
PID 1992 wrote to memory of 3060	1992	15fb185faa29e07681b92fe74a20e749_JaffaCakes118.exe	28
PID 1992 wrote to memory of 3060	1992	15fb185faa29e07681b92fe74a20e749_JaffaCakes118.exe	28
PID 1992 wrote to memory of 3060	1992	15fb185faa29e07681b92fe74a20e749_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\15fb185faa29e07681b92fe74a20e749_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\15fb185faa29e07681b92fe74a20e749_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 36
  2⤵
  - Program crash
  PID:3060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads