1062ee4302ed8c5f97bb35548bc6ad57909aef85e7d632362a2dfd266abf6c0e

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 00:41

Target

a3324799baf5f93b04334e42d4e25ce2_JaffaCakes118.exe
Size

776KB
MD5

a3324799baf5f93b04334e42d4e25ce2
SHA1

952249d2ffb4f4f9ba41669be0309973fc071704
SHA256

1062ee4302ed8c5f97bb35548bc6ad57909aef85e7d632362a2dfd266abf6c0e
SHA512

2d8b9f419cba6e95d35d6564b0a2c26c2c76eb67b619c3ce585fa8421367aea51eee3011fb4a1dc1050f856ad4c677dffbd404ded1c7892a5387dbce69ee3146
SSDEEP

12288:xG34RGZbsqt/egpPeu83dUAAO5K5Ye7iQ0y/XqbrRtMPbhlLBQ:w64sqt2wq0jq2iQ0UXqbrRt0TLBQ

Score

7^/10

upx

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1620-10-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral1/memory/1620-11-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral1/memory/1620-12-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral1/memory/1620-9-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral1/memory/1620-4-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral1/memory/1620-2-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral1/memory/1620-7-0x0000000000400000-0x00000000004F8000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1936 set thread context of 1620	1936	a3324799baf5f93b04334e42d4e25ce2_JaffaCakes118.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
840	1620	WerFault.exe	28

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1620	1936	a3324799baf5f93b04334e42d4e25ce2_JaffaCakes118.exe	28
PID 1936 wrote to memory of 1620	1936	a3324799baf5f93b04334e42d4e25ce2_JaffaCakes118.exe	28
PID 1936 wrote to memory of 1620	1936	a3324799baf5f93b04334e42d4e25ce2_JaffaCakes118.exe	28
PID 1936 wrote to memory of 1620	1936	a3324799baf5f93b04334e42d4e25ce2_JaffaCakes118.exe	28
PID 1936 wrote to memory of 1620	1936	a3324799baf5f93b04334e42d4e25ce2_JaffaCakes118.exe	28
PID 1936 wrote to memory of 1620	1936	a3324799baf5f93b04334e42d4e25ce2_JaffaCakes118.exe	28
PID 1936 wrote to memory of 1620	1936	a3324799baf5f93b04334e42d4e25ce2_JaffaCakes118.exe	28
PID 1936 wrote to memory of 1620	1936	a3324799baf5f93b04334e42d4e25ce2_JaffaCakes118.exe	28
PID 1620 wrote to memory of 840	1620	a3324799baf5f93b04334e42d4e25ce2_JaffaCakes118.exe	29
PID 1620 wrote to memory of 840	1620	a3324799baf5f93b04334e42d4e25ce2_JaffaCakes118.exe	29
PID 1620 wrote to memory of 840	1620	a3324799baf5f93b04334e42d4e25ce2_JaffaCakes118.exe	29
PID 1620 wrote to memory of 840	1620	a3324799baf5f93b04334e42d4e25ce2_JaffaCakes118.exe	29

memory/1620-0-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/1620-10-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/1620-11-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/1620-12-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/1620-9-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/1620-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1620-4-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/1620-2-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/1620-7-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download