bad4e882b383b15237d73d439ee50dcfe6ccf9391c7cfdd0830894530baccee2

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 23:59

Target

ec442d6bb19e42514a0424b6ba47ec75_JaffaCakes118.exe
Size

2.8MB
MD5

ec442d6bb19e42514a0424b6ba47ec75
SHA1

848786bca8cab14cb96de9d5ca3322dd23c5180e
SHA256

bad4e882b383b15237d73d439ee50dcfe6ccf9391c7cfdd0830894530baccee2
SHA512

e31ee30c56e7b42f04ae1ee844c508bd13df1c42cf8939d1eb56dbc170f40b599a63069a6e1cf40e910b9f8f9b5dde8b91ec7472c6691e05edd32b9cba3d52ff
SSDEEP

49152:FmpxOeNhT1xjzwU+Pl8fycpjsxczUvYzzn1wmWF0/fT0x9gUtl:FmjlzwvPlopWUUgCmfj0TgUtl

Score

7^/10

themida

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral1/memory/2184-0-0x00000000002A0000-0x00000000009A0000-memory.dmp	themida
behavioral1/memory/2184-1-0x00000000002A0000-0x00000000009A0000-memory.dmp	themida

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2908	2184	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2908	2184	ec442d6bb19e42514a0424b6ba47ec75_JaffaCakes118.exe	28
PID 2184 wrote to memory of 2908	2184	ec442d6bb19e42514a0424b6ba47ec75_JaffaCakes118.exe	28
PID 2184 wrote to memory of 2908	2184	ec442d6bb19e42514a0424b6ba47ec75_JaffaCakes118.exe	28
PID 2184 wrote to memory of 2908	2184	ec442d6bb19e42514a0424b6ba47ec75_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\ec442d6bb19e42514a0424b6ba47ec75_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ec442d6bb19e42514a0424b6ba47ec75_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 168
  2⤵
  - Program crash
  PID:2908

memory/2184-0-0x00000000002A0000-0x00000000009A0000-memory.dmp

Filesize
7.0MB

Download
memory/2184-1-0x00000000002A0000-0x00000000009A0000-memory.dmp

Filesize
7.0MB

Download