6e772448a99348c7c4c1e52948577447b2c617c0ddd23c4406a8bc802a05b532

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 03:29

Target

0c4c349699d19cb15d0e561664f1adb1_JaffaCakes118.exe
Size

1.2MB
MD5

0c4c349699d19cb15d0e561664f1adb1
SHA1

d304a6cd4cb68e163f9047d9e4ce6426c62c3114
SHA256

6e772448a99348c7c4c1e52948577447b2c617c0ddd23c4406a8bc802a05b532
SHA512

72fdb265959a1bd1917988214136e17eab047f416996b7b85638d8eb6b4f29aca40247a8179482c3ef917dc831fdca8c0436b353eb529805504b801f8f5b2465
SSDEEP

24576:u/1TxIS+JT+1hxwHMI8pGy1BBtVvOWV7YTTKVe:u/1TTfxDtpfVle

Score

7^/10

themida

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral1/memory/948-7-0x0000000000400000-0x000000000065B000-memory.dmp	themida

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1380	948	0c4c349699d19cb15d0e561664f1adb1_JaffaCakes118.exe	21
PID 948 wrote to memory of 1380	948	0c4c349699d19cb15d0e561664f1adb1_JaffaCakes118.exe	21
PID 948 wrote to memory of 1380	948	0c4c349699d19cb15d0e561664f1adb1_JaffaCakes118.exe	21
PID 948 wrote to memory of 1380	948	0c4c349699d19cb15d0e561664f1adb1_JaffaCakes118.exe	21
PID 948 wrote to memory of 1380	948	0c4c349699d19cb15d0e561664f1adb1_JaffaCakes118.exe	21
PID 948 wrote to memory of 1380	948	0c4c349699d19cb15d0e561664f1adb1_JaffaCakes118.exe	21

memory/948-0-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/948-1-0x0000000000660000-0x0000000000742000-memory.dmp

Filesize
904KB

Download
memory/948-3-0x0000000000401000-0x0000000000408000-memory.dmp

Filesize
28KB

Download
memory/948-2-0x00000000007A0000-0x00000000007A2000-memory.dmp

Filesize
8KB

Download
memory/948-7-0x0000000000400000-0x000000000065B000-memory.dmp

Filesize
2.4MB

Download
memory/1380-4-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/1380-11-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download