f41c9ee55a3ed50244bff0398fec752afeec914e231f0ad243faf25ccac5c46f | Triage

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:11

Sharing

Report Analysis Logs

General

Target

b4eddf49f78487cb95c1c70fb99b7466_JaffaCakes118.exe
Size

165KB
MD5

b4eddf49f78487cb95c1c70fb99b7466
SHA1

8397938b050f4986d3adb174a37885e33ba379c6
SHA256

f41c9ee55a3ed50244bff0398fec752afeec914e231f0ad243faf25ccac5c46f
SHA512

04966b422269089a3fc49dc3cab5575f61966fbcaca3657337e3bf1e35c6cc1e2a5a7a71ca91c847aee76b56995b5165a256d92f812d7830810eb6f8da98c987
SSDEEP

3072:BQrKZJq6xU+6/TyJyxA2g+uAayxqytzQ:BFq63IHpuAPd

Score

1^/10

Malware Config

Signatures

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2648	b4eddf49f78487cb95c1c70fb99b7466_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 1204	2648	b4eddf49f78487cb95c1c70fb99b7466_JaffaCakes118.exe	21
PID 2648 wrote to memory of 1204	2648	b4eddf49f78487cb95c1c70fb99b7466_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204
- C:\Users\Admin\AppData\Local\Temp\b4eddf49f78487cb95c1c70fb99b7466_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b4eddf49f78487cb95c1c70fb99b7466_JaffaCakes118.exe"
  2⤵
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-2-0x0000000002A20000-0x0000000002A29000-memory.dmp

Filesize
36KB

Download
memory/1204-1-0x0000000002A20000-0x0000000002A29000-memory.dmp

Filesize
36KB

Download
memory/2648-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2648-4-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download