c4a266eb3d6262ec66061c5d95ab0d9486872725a476a3d0be383864b7c8838f | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6435219763287bf93c18ce256ff6f40e_JaffaCakes118.exe
Size

214KB
MD5

6435219763287bf93c18ce256ff6f40e
SHA1

786331a8f116d888309f09d4bb887dc933e60274
SHA256

c4a266eb3d6262ec66061c5d95ab0d9486872725a476a3d0be383864b7c8838f
SHA512

597d57b3f031658991898968346402bfae19fcdad8d84a531d5b22e569d7fde9d0661cca1f7d09773c9ef33be5eb56a52102dbe8e272014df717a1a41ba8eba6
SSDEEP

6144:+U8EFV2TwCYSVH/kdOShg+fBEhEZU+5P:F8K2T9/kYjUnU+F

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2072	1108	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 2072	1108	6435219763287bf93c18ce256ff6f40e_JaffaCakes118.exe	30
PID 1108 wrote to memory of 2072	1108	6435219763287bf93c18ce256ff6f40e_JaffaCakes118.exe	30
PID 1108 wrote to memory of 2072	1108	6435219763287bf93c18ce256ff6f40e_JaffaCakes118.exe	30
PID 1108 wrote to memory of 2072	1108	6435219763287bf93c18ce256ff6f40e_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\6435219763287bf93c18ce256ff6f40e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6435219763287bf93c18ce256ff6f40e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 36
  2⤵
  - Program crash
  PID:2072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-0-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download