8182affbdc7784bb828be99d3125e9641821fef3fa3b36f978e7b23e2b49ec6b | Triage

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 07:04

Sharing

Report Analysis Logs

General

Target

27a8bb73022191f01ee72cff98f9615a_JaffaCakes118.exe
Size

35KB
MD5

27a8bb73022191f01ee72cff98f9615a
SHA1

1b563285b0b93136dc1f068a46d29d78495171d1
SHA256

8182affbdc7784bb828be99d3125e9641821fef3fa3b36f978e7b23e2b49ec6b
SHA512

1bcfa043fb00f695e40d490069db92e3a247b41296e7f025d9013817d1afea8a649816ea6e4daff1f29e1a9bc44e27772b1d4730b3e23c5bab1269d1a4d807db
SSDEEP

768:tzavuS0FVjk/kuZib+d1NMd7PpaRUa3/e9jn:xav4TNCuMUC

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2200	2168	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2200	2168	27a8bb73022191f01ee72cff98f9615a_JaffaCakes118.exe	30
PID 2168 wrote to memory of 2200	2168	27a8bb73022191f01ee72cff98f9615a_JaffaCakes118.exe	30
PID 2168 wrote to memory of 2200	2168	27a8bb73022191f01ee72cff98f9615a_JaffaCakes118.exe	30
PID 2168 wrote to memory of 2200	2168	27a8bb73022191f01ee72cff98f9615a_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\27a8bb73022191f01ee72cff98f9615a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\27a8bb73022191f01ee72cff98f9615a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 88
  2⤵
  - Program crash
  PID:2200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-0-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/2168-1-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download