ecd54400db0369c93e5d31946132cd3cb4e291bc58fac9b59ea86f11e028ba61

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 20:17

Target

613f632a951664ef1facb0d9a6052270_JaffaCakes118.exe
Size

242KB
MD5

613f632a951664ef1facb0d9a6052270
SHA1

3fd18ea2333e2812083d98966a725c9088bb8866
SHA256

ecd54400db0369c93e5d31946132cd3cb4e291bc58fac9b59ea86f11e028ba61
SHA512

2fc796437296d8b613085d38d38814d11ab8ea83887d9ed8b28817cec2ded3d788da27b3b2af1a56327e61bf29dc1dec9f6988f5c85e5e879f34d1e5ddbe89cc
SSDEEP

3072:FgIjJ2mbKu+aDbI3Np1KeyDJ2TFxG3sY75hsyBgc+2o:FgIjJU6yNp+4FscYH/BXo

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
1800	IS158935.EXE
2384	MSCORELIB.EXE

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\IS158935.EXE	613f632a951664ef1facb0d9a6052270_JaffaCakes118.exe
File created	C:\Windows\MSCORELIB.EXE	613f632a951664ef1facb0d9a6052270_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2940	1800	WerFault.exe	30

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1800	3004	613f632a951664ef1facb0d9a6052270_JaffaCakes118.exe	30
PID 3004 wrote to memory of 1800	3004	613f632a951664ef1facb0d9a6052270_JaffaCakes118.exe	30
PID 3004 wrote to memory of 1800	3004	613f632a951664ef1facb0d9a6052270_JaffaCakes118.exe	30
PID 3004 wrote to memory of 1800	3004	613f632a951664ef1facb0d9a6052270_JaffaCakes118.exe	30
PID 3004 wrote to memory of 2384	3004	613f632a951664ef1facb0d9a6052270_JaffaCakes118.exe	31
PID 3004 wrote to memory of 2384	3004	613f632a951664ef1facb0d9a6052270_JaffaCakes118.exe	31
PID 3004 wrote to memory of 2384	3004	613f632a951664ef1facb0d9a6052270_JaffaCakes118.exe	31
PID 3004 wrote to memory of 2384	3004	613f632a951664ef1facb0d9a6052270_JaffaCakes118.exe	31
PID 1800 wrote to memory of 2940	1800	IS158935.EXE	32
PID 1800 wrote to memory of 2940	1800	IS158935.EXE	32
PID 1800 wrote to memory of 2940	1800	IS158935.EXE	32
PID 1800 wrote to memory of 2940	1800	IS158935.EXE	32

C:\Users\Admin\AppData\Local\Temp\613f632a951664ef1facb0d9a6052270_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\613f632a951664ef1facb0d9a6052270_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\IS158935.EXE
  "C:\Windows\IS158935.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 144
    3⤵
    - Program crash
    PID:2940
- C:\Windows\MSCORELIB.EXE
  "C:\Windows\MSCORELIB.EXE"
  2⤵
  - Executes dropped EXE
  PID:2384

C:\Windows\IS158935.EXE

Filesize
33KB

MD5
58a587cae350db3f19dfa0655b35dad4

SHA1
688c306188754a3c5551d6fb8bba314c2075a812

SHA256
750fa176b57dd2b94f4a58fa9fd0efbc2fa684b43415e6875211fb6fd0d79225

SHA512
8a9e3166798a69b935ad9a5b91e50842accd2effd838ddd2b028b05d29b335a15d949406c4555011b05c6fdd8035366fe353c0505865cfba78a41a3757afb528

Download Submit
C:\Windows\MSCORELIB.EXE

Filesize
188KB

MD5
c419b3375ebe2f0933d18e041b81d53a

SHA1
9895c5dc2cf40850f1184a771a5eb39aa31d9e88

SHA256
c7ef3e78d362dbdfaa47d929095cbb9b6a013662bf96521178841d611501ef2e

SHA512
c601ba43aa66edccf0cd38bff2c8005b1a1935b45ee4b7b6f20ccf415910d8539dba22dd49266fc5624373ec018a14f59ebfc1dbdfd5cdecac7b1335c16f2dac

Download Submit
memory/1800-14-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1800-21-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2384-16-0x000007FEF633E000-0x000007FEF633F000-memory.dmp

Filesize
4KB

Download
memory/2384-17-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

Filesize
9.6MB

Download
memory/2384-18-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

Filesize
9.6MB

Download
memory/2384-19-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

Filesize
9.6MB

Download
memory/2384-20-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

Filesize
9.6MB

Download
memory/3004-12-0x0000000001000000-0x0000000001043000-memory.dmp

Filesize
268KB

Download