2113aa0cdfed638879b22003fec406ef2bd881416789b63f511d9d1d9e6a95f3

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 00:43

Target

43d22080e662218a99f3223f2481abcf_JaffaCakes118.exe
Size

135KB
MD5

43d22080e662218a99f3223f2481abcf
SHA1

56e887c7dccab007c60d192cbb4d001de24e696f
SHA256

2113aa0cdfed638879b22003fec406ef2bd881416789b63f511d9d1d9e6a95f3
SHA512

c5450e8e3eda00f652e895479d00a41e1e65677b705c43a8f65731a45f9743796249cd519a0c90c3d548161a30ea948d71328162fb2ab8bf7e9316cd93c0e0e1
SSDEEP

3072:dnm3DXh2VA9L9Qm3abuwsTrpte7DHGq8WweZnDM2LpqShx0JhOUvwrhUN9Pd/i/:W6C993ASptuHVPRDM28dDi

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2272-8-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2272-7-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2272-4-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2272	43d22080e662218a99f3223f2481abcf_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2272	2904	43d22080e662218a99f3223f2481abcf_JaffaCakes118.exe	28
PID 2904 wrote to memory of 2272	2904	43d22080e662218a99f3223f2481abcf_JaffaCakes118.exe	28
PID 2904 wrote to memory of 2272	2904	43d22080e662218a99f3223f2481abcf_JaffaCakes118.exe	28
PID 2904 wrote to memory of 2272	2904	43d22080e662218a99f3223f2481abcf_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\43d22080e662218a99f3223f2481abcf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\43d22080e662218a99f3223f2481abcf_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Users\Admin\AppData\Local\Temp\43d22080e662218a99f3223f2481abcf_JaffaCakes118.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2272

memory/2272-8-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2272-7-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2272-4-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2272-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2904-0-0x0000000000403000-0x0000000000406000-memory.dmp

Filesize
12KB

Download
memory/2904-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2904-2-0x0000000000403000-0x0000000000406000-memory.dmp

Filesize
12KB

Download