0cd55368015583bc52cacfb50df9b204e0472bed7808e13759031fbf095a48a3

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2024 15:39

Target

9561579da864bdc5689b7558d50566fe_JaffaCakes118.exe
Size

103KB
MD5

9561579da864bdc5689b7558d50566fe
SHA1

09cb246addd6a9e074d3df4e0f18c35daf1830c3
SHA256

0cd55368015583bc52cacfb50df9b204e0472bed7808e13759031fbf095a48a3
SHA512

84c4c78d991c2af711e38014d1213621843306ba129acf5e0aac02e1f2cf20a167466b2ec90f266f48520cd49d892e667d24a1d58bc4b2228313039775cd4ff2
SSDEEP

1536:HX90TZBqR1xryR+1R3//9sKGDYbsPs12eSgcvNucKBiLmXjZELXmbXQJc2:HqusRo//SKHbas12eSNQGmXt0QXQJc

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4608-0-0x0000000000BC0000-0x0000000000BEC000-memory.dmp	upx
behavioral2/memory/4608-1-0x0000000000BC0000-0x0000000000BEC000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2512	4608	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 8 IoCs

C:\Users\Admin\AppData\Local\Temp\9561579da864bdc5689b7558d50566fe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9561579da864bdc5689b7558d50566fe_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 580
  2⤵
  - Program crash
  PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4608 -ip 4608
1⤵
PID:1432

memory/4608-0-0x0000000000BC0000-0x0000000000BEC000-memory.dmp

Filesize
176KB

Download
memory/4608-2-0x0000000000BC6000-0x0000000000BCC000-memory.dmp

Filesize
24KB

Download
memory/4608-1-0x0000000000BC0000-0x0000000000BEC000-memory.dmp

Filesize
176KB

Download