3d07bc807285c4a3e531ffbc1cc2628317dabbd5ec5ab1e563ac78fd4f451dca

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 04:22

Target

f2aea176bf7ba0aa4cf5eb97ed4fe48c_JaffaCakes118.exe
Size

134KB
MD5

f2aea176bf7ba0aa4cf5eb97ed4fe48c
SHA1

c09f79caf3798309a2c2824828dacd5b8e12f55a
SHA256

3d07bc807285c4a3e531ffbc1cc2628317dabbd5ec5ab1e563ac78fd4f451dca
SHA512

f7e44679dca0bc77107e78fffbc1b53bc0aaba034f5cde743f3aa42bfda3477819cf92e75630935d5b5d7cc40f157b35ab6805579886c143df27a94018ac3cbf
SSDEEP

3072:DWDtCioND4j6uLyzUZuSiV+mmIPaZEI/mWd4dE:S1oNDqWzUHiUmJZlw4d

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2168-0-0x0000000000400000-0x0000000000434000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2168	f2aea176bf7ba0aa4cf5eb97ed4fe48c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1272	2168	f2aea176bf7ba0aa4cf5eb97ed4fe48c_JaffaCakes118.exe	28
PID 2168 wrote to memory of 1272	2168	f2aea176bf7ba0aa4cf5eb97ed4fe48c_JaffaCakes118.exe	28
PID 2168 wrote to memory of 1272	2168	f2aea176bf7ba0aa4cf5eb97ed4fe48c_JaffaCakes118.exe	28
PID 2168 wrote to memory of 1272	2168	f2aea176bf7ba0aa4cf5eb97ed4fe48c_JaffaCakes118.exe	28
PID 2168 wrote to memory of 1272	2168	f2aea176bf7ba0aa4cf5eb97ed4fe48c_JaffaCakes118.exe	28
PID 2168 wrote to memory of 1272	2168	f2aea176bf7ba0aa4cf5eb97ed4fe48c_JaffaCakes118.exe	28
PID 2168 wrote to memory of 1272	2168	f2aea176bf7ba0aa4cf5eb97ed4fe48c_JaffaCakes118.exe	28

memory/1272-4-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1272-5-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1272-8-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1272-7-0x00000000005A0000-0x00000000005A8000-memory.dmp

Filesize
32KB

Download
memory/1272-11-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2168-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2168-2-0x0000000000300000-0x0000000000302000-memory.dmp

Filesize
8KB

Download
memory/2168-3-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2168-6-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download