521524ee73ae1173ef03cc1f7590afc794111bcf00d1f1793f10562a8b0bf55a

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 11:23

Target

0de2351a239944bdb14c49d905a1e012_JaffaCakes118.exe
Size

103KB
MD5

0de2351a239944bdb14c49d905a1e012
SHA1

17b4e468794ae4b7895d7f4cbede18920f7d5335
SHA256

521524ee73ae1173ef03cc1f7590afc794111bcf00d1f1793f10562a8b0bf55a
SHA512

4014efc6dc8d7215d5fc35f9231c8b515128c60db05c751530192176445787a94cdbdd186bba172765545d852b5598f1995bcf7156a038fd92c8b0c44ff62a9e
SSDEEP

1536:xO3aPbLOQTpCPeNEZwi91zfnOaQiBjLDD7yBl6RHCfHZP9qqX/xKHR:c3ALVTpitZwcfOa5BT+l6RifHx9qKuR

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2248-2-0x0000000000400000-0x000000000043C000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2940	2248	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2940	2248	0de2351a239944bdb14c49d905a1e012_JaffaCakes118.exe	28
PID 2248 wrote to memory of 2940	2248	0de2351a239944bdb14c49d905a1e012_JaffaCakes118.exe	28
PID 2248 wrote to memory of 2940	2248	0de2351a239944bdb14c49d905a1e012_JaffaCakes118.exe	28
PID 2248 wrote to memory of 2940	2248	0de2351a239944bdb14c49d905a1e012_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0de2351a239944bdb14c49d905a1e012_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0de2351a239944bdb14c49d905a1e012_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 184
  2⤵
  - Program crash
  PID:2940

memory/2248-0-0x00000000002A0000-0x00000000002DC000-memory.dmp

Filesize
240KB

Download
memory/2248-1-0x0000000000415000-0x0000000000421000-memory.dmp

Filesize
48KB

Download
memory/2248-2-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download