aa1bc0eef0806b9e2e5d073872f95ee8ade41e561cb800df0ea7aa8c7109f603

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 20:28

Target

3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe
Size

18KB
MD5

3a9b056c0f6e767f0e8f51e4ecfda6a3
SHA1

3ea6a0531c06b65015a1ac297224b80dd26a2975
SHA256

aa1bc0eef0806b9e2e5d073872f95ee8ade41e561cb800df0ea7aa8c7109f603
SHA512

3808abab49f1a538c3dedb0158d2d5e96b845b39355cd1a733cfa67526898e935461c437f9d054cbc78e6a637d837dd881f33310ab6ca44c2d9337e8ec1a4dc6
SSDEEP

48:QMIIILeOnNgg1EEWsiryoizX6U9CBanlEP+/y6CXduvdHyRIpm4H3AVauwOL9xCl:QjNgOAi4vwFSRh/9x1gajwF

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2524	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2684	2220	WerFault.exe	31

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2524	2968	3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe	30
PID 2968 wrote to memory of 2524	2968	3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe	30
PID 2968 wrote to memory of 2524	2968	3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe	30
PID 2968 wrote to memory of 2524	2968	3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe	30
PID 2968 wrote to memory of 2220	2968	3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe	31
PID 2968 wrote to memory of 2220	2968	3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe	31
PID 2968 wrote to memory of 2220	2968	3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe	31
PID 2968 wrote to memory of 2220	2968	3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe	31
PID 2968 wrote to memory of 2220	2968	3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe	31
PID 2220 wrote to memory of 2684	2220	svchost.exe	33
PID 2220 wrote to memory of 2684	2220	svchost.exe	33
PID 2220 wrote to memory of 2684	2220	svchost.exe	33
PID 2220 wrote to memory of 2684	2220	svchost.exe	33

C:\Users\Admin\AppData\Local\Temp\3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c.bat C:\Users\Admin\AppData\Local\Temp\3a9b056c0f6e767f0e8f51e4ecfda6a3_JaffaCakes118.exe
  2⤵
  - Deletes itself
  PID:2524
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 52
    3⤵
    - Program crash
    PID:2684

C:\Users\Admin\AppData\Local\Temp\c.bat

Filesize
404B

MD5
6c2f63698a08b310db71328b270a24f7

SHA1
dbfc63343722e2b7860b58d64cc89081207ed6d2

SHA256
38f8f02665b6dc6653faf8d93bcd98b61af2d8d080f8eb37d14938838b0c220e

SHA512
218708d4251186eca1b53d62067d6d2bea2c3dbfc937984cd26172d99f3f6f38a81a7fbc470da2d9df8d1185bc69468a2fcfc7de7cfa6291fa913fb71c2c5e8d

Download Submit
memory/2220-9-0x0000000000BB2000-0x0000000000BB3000-memory.dmp

Filesize
4KB

Download
memory/2968-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2968-8-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download