4033c178005bc83ade36bc435b0f9e2d2f5cdc5b0f146aaa1675e3bb08d2fda4

Analysis

max time kernel
139s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 22:04

Target

0fb1b048f54fb23a79b2cde74b240127_JaffaCakes118.exe
Size

114KB
MD5

0fb1b048f54fb23a79b2cde74b240127
SHA1

7d6edbc935d0f53ed8b276c3ad144aaeba32db98
SHA256

4033c178005bc83ade36bc435b0f9e2d2f5cdc5b0f146aaa1675e3bb08d2fda4
SHA512

62f8f5bd55e2a97a5f82b31635512fdf03f774789f871caf4898d6aee3f3548144007e7a04f3d1c64d1caee778f9013aaba6b7b748c1534731e666579a0e9af0
SSDEEP

3072:3Ig/V3NlvMTXdGLGzTXk3/tTCaxY/OVL:53DvMTXdgSY31TMO

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3152-0-0x0000000000400000-0x0000000000438000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3152	0fb1b048f54fb23a79b2cde74b240127_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 1308	3152	0fb1b048f54fb23a79b2cde74b240127_JaffaCakes118.exe	86
PID 3152 wrote to memory of 1308	3152	0fb1b048f54fb23a79b2cde74b240127_JaffaCakes118.exe	86
PID 3152 wrote to memory of 1308	3152	0fb1b048f54fb23a79b2cde74b240127_JaffaCakes118.exe	86
PID 3152 wrote to memory of 1308	3152	0fb1b048f54fb23a79b2cde74b240127_JaffaCakes118.exe	86
PID 3152 wrote to memory of 1308	3152	0fb1b048f54fb23a79b2cde74b240127_JaffaCakes118.exe	86

memory/3152-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3152-1-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/3152-3-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3152-2-0x0000000000420000-0x000000000042E000-memory.dmp

Filesize
56KB

Download