211b51c7e8e6cd5865972a5aa75bde7d7471a1997fa9567bd62d12383828c0ca

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:25

Target

68fdcde789ddc6c8722a8e72dd311158_JaffaCakes118.exe
Size

161KB
MD5

68fdcde789ddc6c8722a8e72dd311158
SHA1

e9325dad6525d0226cea2198a76d2280f8a7859a
SHA256

211b51c7e8e6cd5865972a5aa75bde7d7471a1997fa9567bd62d12383828c0ca
SHA512

8d0fde6567c8040b6bfbbe00ab4618c82a83a23047c2a8daf51aa4fee0cef9373c8c7b6227e8c06a5789c182ea92170ad81bee4e3ad7d0fc9b3c5307572a86b4
SSDEEP

3072:GEGlIUEqC4qpN789Qqw0GCRrT4BvXkFc+B4clJqr88U8oEL:B5UEqM789Tw0xRYBv0u+Bl3EnoEL

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2384-5-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2384-9-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2384-8-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

68fdcde789ddc6c8722a8e72dd311158_JaffaCakes118.exe

description	pid	process	target process
PID 2104 wrote to memory of 2384	2104	68fdcde789ddc6c8722a8e72dd311158_JaffaCakes118.exe	68fdcde789ddc6c8722a8e72dd311158_JaffaCakes118.exe
PID 2104 wrote to memory of 2384	2104	68fdcde789ddc6c8722a8e72dd311158_JaffaCakes118.exe	68fdcde789ddc6c8722a8e72dd311158_JaffaCakes118.exe
PID 2104 wrote to memory of 2384	2104	68fdcde789ddc6c8722a8e72dd311158_JaffaCakes118.exe	68fdcde789ddc6c8722a8e72dd311158_JaffaCakes118.exe
PID 2104 wrote to memory of 2384	2104	68fdcde789ddc6c8722a8e72dd311158_JaffaCakes118.exe	68fdcde789ddc6c8722a8e72dd311158_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\68fdcde789ddc6c8722a8e72dd311158_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68fdcde789ddc6c8722a8e72dd311158_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104

C:\Users\Admin\AppData\Local\Temp\68fdcde789ddc6c8722a8e72dd311158_JaffaCakes118.exe
?
2⤵
PID:2384

memory/2104-0-0x0000000000419000-0x000000000041C000-memory.dmp

Filesize
12KB

Download
memory/2104-3-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2104-2-0x0000000000419000-0x000000000041C000-memory.dmp

Filesize
12KB

Download
memory/2384-4-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2384-5-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2384-9-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2384-8-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2384-10-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download