Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20/07/2024, 07:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5f86f5971d22e09dd2a43d7bab6d1853_JaffaCakes118.exe
Resource
win7-20240708-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
5f86f5971d22e09dd2a43d7bab6d1853_JaffaCakes118.exe
Resource
win10v2004-20240709-en
1 signatures
150 seconds
General
-
Target
5f86f5971d22e09dd2a43d7bab6d1853_JaffaCakes118.exe
-
Size
115KB
-
MD5
5f86f5971d22e09dd2a43d7bab6d1853
-
SHA1
443bf35adfab49ed6b65965b9735ca7023c90ed8
-
SHA256
6feee6221d834966daa34cc6d58b86fbb1db747210d77962870911bd59841d03
-
SHA512
1566dc7f00c2a8c926bd5c6fa44f98840365e0a870df92c7ad3faeb2aa0f1f84b5208d0cabff993600dc6b6484ecd602d60bda8295936242fdee1d6cd62affe7
-
SSDEEP
3072:xvQGodyQsr/sM3HGK5+Xa9Yd23S9Efly8mJ6gRMjqEm3:ySr/hGK5+XIXIvEm3
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2360 2396 WerFault.exe 29 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2396 wrote to memory of 2360 2396 5f86f5971d22e09dd2a43d7bab6d1853_JaffaCakes118.exe 30 PID 2396 wrote to memory of 2360 2396 5f86f5971d22e09dd2a43d7bab6d1853_JaffaCakes118.exe 30 PID 2396 wrote to memory of 2360 2396 5f86f5971d22e09dd2a43d7bab6d1853_JaffaCakes118.exe 30 PID 2396 wrote to memory of 2360 2396 5f86f5971d22e09dd2a43d7bab6d1853_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f86f5971d22e09dd2a43d7bab6d1853_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5f86f5971d22e09dd2a43d7bab6d1853_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 362⤵
- Program crash
PID:2360
-