71e72293bbfebfb67fb7ea78810970811e5586132555badcc163fccf7a6e5c47

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 16:18

Target

f62d2bb74b9a2050b1af1919807c87a5_JaffaCakes118.exe
Size

39KB
MD5

f62d2bb74b9a2050b1af1919807c87a5
SHA1

3ee838a79202e20681538d9ef1d5b99f6a70e815
SHA256

71e72293bbfebfb67fb7ea78810970811e5586132555badcc163fccf7a6e5c47
SHA512

96e6b0a3460c1a6fbd1e1224c445b9c0d17e4035813d8aa401317f13726885459bf5db9bd1835b8386290c9e1eb659ac31dcc54aa1076b2e2436aa4d43a0a410
SSDEEP

384:djIfTIk7MeYm5j63JRM17TFEOGqUksLMN6jf+u9w+gJPUfAHfgX7fJ7m6We:q1M13JRMIDqUkAolq9Pfo+Jye

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2856-0-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/2856-1-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2908	2856	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2908	2856	f62d2bb74b9a2050b1af1919807c87a5_JaffaCakes118.exe	28
PID 2856 wrote to memory of 2908	2856	f62d2bb74b9a2050b1af1919807c87a5_JaffaCakes118.exe	28
PID 2856 wrote to memory of 2908	2856	f62d2bb74b9a2050b1af1919807c87a5_JaffaCakes118.exe	28
PID 2856 wrote to memory of 2908	2856	f62d2bb74b9a2050b1af1919807c87a5_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f62d2bb74b9a2050b1af1919807c87a5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f62d2bb74b9a2050b1af1919807c87a5_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 44
  2⤵
  - Program crash
  PID:2908

memory/2856-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2856-1-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download