cec75ab9c0ff3221d3fc0fae081110b08042f5f05c99d4f858de9b1617fe4688

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 00:10

Target

050fd7bcf5961a2ead0f00c2dcdbd895_JaffaCakes118.exe
Size

268KB
MD5

050fd7bcf5961a2ead0f00c2dcdbd895
SHA1

79317536301df4b125a4a97e2213a2cc6c406932
SHA256

cec75ab9c0ff3221d3fc0fae081110b08042f5f05c99d4f858de9b1617fe4688
SHA512

fb50ca7848c7eb70be05116b7b6fb80d43763524bb539ba3aa5a3f0b8ded0dde05b3284511accefe06a8e72ae4d1e3d6fe80d2c7aa3f3eb58da9fb994b02dce2
SSDEEP

6144:uP2bvKyCPkpBYR/z11RQirDaIHmhCGYN5mOvtqDXlKq0X:uP2bvO8PE/zpHnGYN5PAFK

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2068-2-0x0000000010000000-0x0000000010020000-memory.dmp	upx
behavioral1/memory/2068-4-0x0000000010000000-0x0000000010020000-memory.dmp	upx
behavioral1/memory/2068-0-0x0000000010000000-0x0000000010020000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1660	2068	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 1660	2068	050fd7bcf5961a2ead0f00c2dcdbd895_JaffaCakes118.exe	28
PID 2068 wrote to memory of 1660	2068	050fd7bcf5961a2ead0f00c2dcdbd895_JaffaCakes118.exe	28
PID 2068 wrote to memory of 1660	2068	050fd7bcf5961a2ead0f00c2dcdbd895_JaffaCakes118.exe	28
PID 2068 wrote to memory of 1660	2068	050fd7bcf5961a2ead0f00c2dcdbd895_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\050fd7bcf5961a2ead0f00c2dcdbd895_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\050fd7bcf5961a2ead0f00c2dcdbd895_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 116
  2⤵
  - Program crash
  PID:1660

memory/2068-2-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2068-4-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2068-0-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download