28bc58026cae6b33295ee5b138e4cda4fb174570bae4646f584db4cb94f3d2b4

Analysis

max time kernel
139s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
22/06/2024, 10:36

Target
01b105bec2159325e1225a55b7bed248_JaffaCakes118.exe
Size 2.1MB
Sample240622-mnpy4svajc
SHA256 28bc58026cae6b33295ee5b138e4cda4fb174570bae4646f584db4cb94f3d2b4
MD5 01b105bec2159325e1225a55b7bed248
SHA1 73b53f0e50679b50ba3aae26c539935ffc417a25
SHA512 6e061bcdaf9e028298968f179f1267653f6ee230206e398b49c72edc3a277ff3b560e6b61b8e4f47b49ffa26ba4b4e2efc587b01c819e8f10f0757bd92e10018
SSDEEP 49152:V1Wd46hen6dhZhOOtSkOI/WeP1g0Ztgd0gUigY6ukXO:adLk6dhXfSkOI/LXZta0prXO
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1708-0-0x0000000000400000-0x0000000000842500-memory.dmp	upx
behavioral2/memory/1708-1-0x0000000000400000-0x0000000000842500-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
868	1708	WerFault.exe	89

C:\Users\Admin\AppData\Local\Temp\01b105bec2159325e1225a55b7bed248_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01b105bec2159325e1225a55b7bed248_JaffaCakes118.exe"
1⤵
PID:1708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 476
  2⤵
  - Program crash
  PID:868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1708 -ip 1708
1⤵
PID:4300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4252,i,2113996974559895641,18156918660790954073,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
1⤵
PID:4092

memory/1708-0-0x0000000000400000-0x0000000000842500-memory.dmp

Download

memory/1708-1-0x0000000000400000-0x0000000000842500-memory.dmp

Download