364a4abb2ddafb2981c91f0ef0fff22dae4e2dfd7070d488ecd03498cc9ff075

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 11:32

Target

059a626745ba27071dc8c1f852563c66_JaffaCakes118.exe
Size

130KB
MD5

059a626745ba27071dc8c1f852563c66
SHA1

334bdfe012934eb863d35134b492c8b4fe1e6e37
SHA256

364a4abb2ddafb2981c91f0ef0fff22dae4e2dfd7070d488ecd03498cc9ff075
SHA512

d1a16491bbb665ee6263d05a98b71f978fc02ce89fdb80981dc2ca27f6ba273ac80acb993beac11a9c9ea777f1baa85e8d6469f5242ceea882c657a4599ab359
SSDEEP

3072:bGMFQazA8UyCvixswf2VNfDGwvgDuydoOUjc7bsaGI/5:b3FQa7XxJMvhyyOUQ7lGI

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2648-0-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/2648-2-0x0000000000400000-0x000000000042F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
976	2648	WerFault.exe	82

C:\Users\Admin\AppData\Local\Temp\059a626745ba27071dc8c1f852563c66_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\059a626745ba27071dc8c1f852563c66_JaffaCakes118.exe"
1⤵
PID:2648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 324
  2⤵
  - Program crash
  PID:976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2648 -ip 2648
1⤵
PID:3864

memory/2648-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2648-1-0x00000000008A0000-0x00000000008A2000-memory.dmp

Filesize
8KB

Download
memory/2648-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download