4f36bbf9bf03eedc7bf9f134896b8de5775961bc26b8e0bc84214abffe027928 | Triage

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 01:54

Sharing

Report Analysis Logs

General

Target

5e96bcbc3029c01a1aef778574206e85_JaffaCakes118.exe
Size

859KB
MD5

5e96bcbc3029c01a1aef778574206e85
SHA1

b7981ac69998b3a3e59bd1c514bb008bf5cedf19
SHA256

4f36bbf9bf03eedc7bf9f134896b8de5775961bc26b8e0bc84214abffe027928
SHA512

54be36881309c5ac4e8307d53dd299aa40b2d298931615515812b497084bc77962871ebbed97a52177218381d0cabd87ecdd594b5d9ae122b828c2136b5480aa
SSDEEP

24576:yGci0hv+dZaUzTUPW64KSGWZr63UzpEIb4u:swZaUQU1cu

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2156	1292	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 2156	1292	5e96bcbc3029c01a1aef778574206e85_JaffaCakes118.exe	30
PID 1292 wrote to memory of 2156	1292	5e96bcbc3029c01a1aef778574206e85_JaffaCakes118.exe	30
PID 1292 wrote to memory of 2156	1292	5e96bcbc3029c01a1aef778574206e85_JaffaCakes118.exe	30
PID 1292 wrote to memory of 2156	1292	5e96bcbc3029c01a1aef778574206e85_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\5e96bcbc3029c01a1aef778574206e85_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5e96bcbc3029c01a1aef778574206e85_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 92
  2⤵
  - Program crash
  PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads