d968fc01ce5e604515a27226c938fbe09256db97da206e8e74c8a06ffd1e4fa4

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 00:16

Target

7747fb3574fddef7bf04c2a0cb8500d0_JaffaCakes118.exe
Size

264KB
MD5

7747fb3574fddef7bf04c2a0cb8500d0
SHA1

92be0988fa9c5d634b38847b1d2199e54ca2fe4f
SHA256

d968fc01ce5e604515a27226c938fbe09256db97da206e8e74c8a06ffd1e4fa4
SHA512

a5c6c9458cfc407c1c8a18298c332c3c41f50972c20e59ace5ee922a8e6d3a5661bfeccbaa7b10bc4b6250f4a5808bc281a2bf8a5dac0134533e548c905e7ca2
SSDEEP

6144:Md8oCITmlIXXeF+omLw98TstAYAyxm+UU8ez9Y:E/PTmqXy+FL9TsfxFUU8ez9Y

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2148-0-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/2148-1-0x0000000000400000-0x0000000000468000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3036 2148 WerFault.exe 7747fb3574fddef7bf04c2a0cb8500d0_JaffaCakes118.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7747fb3574fddef7bf04c2a0cb8500d0_JaffaCakes118.exe

pid process

2148 7747fb3574fddef7bf04c2a0cb8500d0_JaffaCakes118.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

7747fb3574fddef7bf04c2a0cb8500d0_JaffaCakes118.exe

pid process

2148 7747fb3574fddef7bf04c2a0cb8500d0_JaffaCakes118.exe

pid	pid_target	process	target process
3036	2148	WerFault.exe	7747fb3574fddef7bf04c2a0cb8500d0_JaffaCakes118.exe

pid	process
2148	7747fb3574fddef7bf04c2a0cb8500d0_JaffaCakes118.exe

pid	process
2148	7747fb3574fddef7bf04c2a0cb8500d0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7747fb3574fddef7bf04c2a0cb8500d0_JaffaCakes118.exe

description	pid	process	target process
PID 2148 wrote to memory of 3036	2148	7747fb3574fddef7bf04c2a0cb8500d0_JaffaCakes118.exe	WerFault.exe
PID 2148 wrote to memory of 3036	2148	7747fb3574fddef7bf04c2a0cb8500d0_JaffaCakes118.exe	WerFault.exe
PID 2148 wrote to memory of 3036	2148	7747fb3574fddef7bf04c2a0cb8500d0_JaffaCakes118.exe	WerFault.exe
PID 2148 wrote to memory of 3036	2148	7747fb3574fddef7bf04c2a0cb8500d0_JaffaCakes118.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 232
2⤵
- Program crash
PID:3036

memory/2148-0-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2148-1-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download