f9a85dbc37d5e7f3c68e46f43f719a7bc934b61a9f6cde9a34d10f4fbd14a593 | Triage

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 12:40

Sharing

Report Analysis Logs

General

Target

3926b918fffa7735ab4275de62be1d06_JaffaCakes118.exe
Size

1KB
MD5

3926b918fffa7735ab4275de62be1d06
SHA1

8be46442a08e9a1959aa7f1c21c1598120fcef46
SHA256

f9a85dbc37d5e7f3c68e46f43f719a7bc934b61a9f6cde9a34d10f4fbd14a593
SHA512

8e13a5252c6717a6696eb0cc981636171bdb7c61a22197be3e8ed954ae6c428427e73781171a7da1a0e93cd6938b8d74a0448aa11af061a7f12d7dbf49a926af

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2356	2060	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2356	2060	3926b918fffa7735ab4275de62be1d06_JaffaCakes118.exe	30
PID 2060 wrote to memory of 2356	2060	3926b918fffa7735ab4275de62be1d06_JaffaCakes118.exe	30
PID 2060 wrote to memory of 2356	2060	3926b918fffa7735ab4275de62be1d06_JaffaCakes118.exe	30
PID 2060 wrote to memory of 2356	2060	3926b918fffa7735ab4275de62be1d06_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3926b918fffa7735ab4275de62be1d06_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3926b918fffa7735ab4275de62be1d06_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 88
  2⤵
  - Program crash
  PID:2356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2060-0-0x0000000000400000-0x00000000004031A4-memory.dmp

Filesize
12KB

Download