59cb3532ff2cc400dad827ea7c3c5a8df014c565b5d8c4b652955065538741dc

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 19:33

Target

0a701ac3cdffb519413994407c0be1ff_JaffaCakes118.exe
Size

105KB
MD5

0a701ac3cdffb519413994407c0be1ff
SHA1

8ffb2872cc2c0bc85543ebd7e566ae95528dfe9c
SHA256

59cb3532ff2cc400dad827ea7c3c5a8df014c565b5d8c4b652955065538741dc
SHA512

f01e9ccc8eaf42291ecf432da5f4ef7c223cd86791b89520e6df7f877849b97431ee95e519b8130cb630980efa7a100b25f866ec936a02b092e49db316b3b1a0
SSDEEP

3072:qzpB90AwLIOM4lT63ybS4tYqT9eMEJjBSwk:2AA74h6yS4tfgJQv

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2964-0-0x0000000000400000-0x0000000000436000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2964	0a701ac3cdffb519413994407c0be1ff_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2996	2964	0a701ac3cdffb519413994407c0be1ff_JaffaCakes118.exe	28
PID 2964 wrote to memory of 2996	2964	0a701ac3cdffb519413994407c0be1ff_JaffaCakes118.exe	28
PID 2964 wrote to memory of 2996	2964	0a701ac3cdffb519413994407c0be1ff_JaffaCakes118.exe	28
PID 2964 wrote to memory of 2996	2964	0a701ac3cdffb519413994407c0be1ff_JaffaCakes118.exe	28
PID 2964 wrote to memory of 2996	2964	0a701ac3cdffb519413994407c0be1ff_JaffaCakes118.exe	28
PID 2964 wrote to memory of 2996	2964	0a701ac3cdffb519413994407c0be1ff_JaffaCakes118.exe	28
PID 2964 wrote to memory of 2996	2964	0a701ac3cdffb519413994407c0be1ff_JaffaCakes118.exe	28

memory/2964-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2964-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2964-1-0x0000000000350000-0x0000000000352000-memory.dmp

Filesize
8KB

Download
memory/2964-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2996-3-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2996-4-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2996-6-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2996-9-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download