520e488e3f6cbebd0369e024a852cb340920806d40a03e7cc3dfeb7b1502ccce

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 17:18

Target

79e36782e216063d2debbbe81fff06b1_JaffaCakes118.exe
Size

568KB
MD5

79e36782e216063d2debbbe81fff06b1
SHA1

922cd05e48aa43670e509c566b44ae6f294596b5
SHA256

520e488e3f6cbebd0369e024a852cb340920806d40a03e7cc3dfeb7b1502ccce
SHA512

97777b3938f1804f27a7e5ea0c5f26fdf86b0c4fce714a910d75acfbb8b08be46f8fcbd9420437d149831a81bacd23146fd451b6f2245040523544b210427b57
SSDEEP

12288:Kt6N6zcrLltBmnMWPFCzSz5oVFZL5nJX+RvbOUvhp3cSrEdIv:4zcrLFmrkz8GVSv1z3cEEdI

Score

7^/10

upx

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2596-41-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2596-34-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2596-40-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2596-39-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2596-38-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2596-36-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2596-30-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral1/memory/2596-28-0x0000000000400000-0x0000000000586000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2236 set thread context of 2596	2236	79e36782e216063d2debbbe81fff06b1_JaffaCakes118.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2892	2596	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2236	79e36782e216063d2debbbe81fff06b1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2596	2236	79e36782e216063d2debbbe81fff06b1_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2596	2236	79e36782e216063d2debbbe81fff06b1_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2596	2236	79e36782e216063d2debbbe81fff06b1_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2596	2236	79e36782e216063d2debbbe81fff06b1_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2596	2236	79e36782e216063d2debbbe81fff06b1_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2596	2236	79e36782e216063d2debbbe81fff06b1_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2596	2236	79e36782e216063d2debbbe81fff06b1_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2596	2236	79e36782e216063d2debbbe81fff06b1_JaffaCakes118.exe	28
PID 2596 wrote to memory of 2892	2596	79e36782e216063d2debbbe81fff06b1_JaffaCakes118.exe	29
PID 2596 wrote to memory of 2892	2596	79e36782e216063d2debbbe81fff06b1_JaffaCakes118.exe	29
PID 2596 wrote to memory of 2892	2596	79e36782e216063d2debbbe81fff06b1_JaffaCakes118.exe	29
PID 2596 wrote to memory of 2892	2596	79e36782e216063d2debbbe81fff06b1_JaffaCakes118.exe	29

memory/2236-2-0x0000000000489000-0x000000000048A000-memory.dmp

Filesize
4KB

Download
memory/2236-25-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2236-19-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2236-37-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2596-38-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2596-39-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2596-40-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2596-34-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2596-36-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2596-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2596-30-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2596-28-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2596-26-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2596-41-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download