9278955ca121d670ee1f323cbc26f6a1a24e564731602f84ecb1ac9f60d4a37b

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 14:23

Target

287903a493c188dd2d5079b219ea35b2_JaffaCakes118.exe
Size

1.7MB
MD5

287903a493c188dd2d5079b219ea35b2
SHA1

1d0d3279a3065fd637b006064658caa077dfa775
SHA256

9278955ca121d670ee1f323cbc26f6a1a24e564731602f84ecb1ac9f60d4a37b
SHA512

ab76efeb9b4cceaa1973fcaac1c24074f205b7ab9cbc45d6cd56f1ee31bbb2bb1852a0e3f76cb2464da4e8ddc9dbe34fd71528c1570a98c4fa4eb2f3df53cb6d
SSDEEP

24576:IqFvIGdi2k88MNbF7y/zCjb9IlzPDOqyeKMrTEqNjNN7aK+7zWRTTlK1GcKqUd:+Gdi0FZqxz7PgMrTEsjz7aK+7z8enUd

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2104	287903a493c188dd2d5079b219ea35b2_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\vcorp.dll	287903a493c188dd2d5079b219ea35b2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\vcorp.dll	287903a493c188dd2d5079b219ea35b2_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3008	2104	WerFault.exe	29

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2104	287903a493c188dd2d5079b219ea35b2_JaffaCakes118.exe
2104	287903a493c188dd2d5079b219ea35b2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 3008	2104	287903a493c188dd2d5079b219ea35b2_JaffaCakes118.exe	30
PID 2104 wrote to memory of 3008	2104	287903a493c188dd2d5079b219ea35b2_JaffaCakes118.exe	30
PID 2104 wrote to memory of 3008	2104	287903a493c188dd2d5079b219ea35b2_JaffaCakes118.exe	30
PID 2104 wrote to memory of 3008	2104	287903a493c188dd2d5079b219ea35b2_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\287903a493c188dd2d5079b219ea35b2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\287903a493c188dd2d5079b219ea35b2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 200
  2⤵
  - Program crash
  PID:3008

\Windows\SysWOW64\vcorp.dll

Filesize
92KB

MD5
1ac188e1edc023d38b2b3a68dca2a6a7

SHA1
a51c074b34b2e68a758fb0e1c4c48724c2044156

SHA256
f3ace0d7525368cbbf4a3ef836f63ed7fe4ca9e492f0c96b241561e9734fd9fa

SHA512
81129563e47c4d0dcd78c90fa076ae3309197ba41dc9d9403eb1fdfa6ec0f852f9da640d58c49cccd40673c82d4896a02bab4c64bdd71852ed09cf7ba130abaf

Download Submit
memory/2104-3-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download