e738a9ea0a5d8bdf6c0ff0cdb3578474aa262d0079f4c2c855baee6ca2d3d248

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 05:19

Target

fe861bd7865857809ed71b3a31f0626d_JaffaCakes118.exe
Size

112KB
MD5

fe861bd7865857809ed71b3a31f0626d
SHA1

c40b966875ab2493152c92d03411349c275e01a3
SHA256

e738a9ea0a5d8bdf6c0ff0cdb3578474aa262d0079f4c2c855baee6ca2d3d248
SHA512

750fe9ccad5cc1378b934f7947e34d01e2d99ed3f5589c1e28ba841be7c8abdc7e909c646805e1643c671470b644f4832befa469057de0bb3cc66f4d0c0a0b6c
SSDEEP

3072:JHtFrMYjTwFI+RHJuIEMr+1tsU31Vg12P:JHjMvS+tJuIhOB1N

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1992-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1992	fe861bd7865857809ed71b3a31f0626d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2700	1992	fe861bd7865857809ed71b3a31f0626d_JaffaCakes118.exe	28
PID 1992 wrote to memory of 2700	1992	fe861bd7865857809ed71b3a31f0626d_JaffaCakes118.exe	28
PID 1992 wrote to memory of 2700	1992	fe861bd7865857809ed71b3a31f0626d_JaffaCakes118.exe	28
PID 1992 wrote to memory of 2700	1992	fe861bd7865857809ed71b3a31f0626d_JaffaCakes118.exe	28
PID 1992 wrote to memory of 2700	1992	fe861bd7865857809ed71b3a31f0626d_JaffaCakes118.exe	28
PID 1992 wrote to memory of 2700	1992	fe861bd7865857809ed71b3a31f0626d_JaffaCakes118.exe	28
PID 1992 wrote to memory of 2700	1992	fe861bd7865857809ed71b3a31f0626d_JaffaCakes118.exe	28

memory/1992-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1992-1-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/1992-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1992-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2700-3-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2700-4-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2700-6-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2700-9-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download