53ffc1d3fa63f21f7d3c28227be4fe592155c26dac5e89714559ca3c70a46ac7

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 12:39

Target

1a25ab1538022dc63b437734d1d1a58d_JaffaCakes118.exe
Size

100KB
MD5

1a25ab1538022dc63b437734d1d1a58d
SHA1

677853f31e853c0bdcc4997153598c6dafb59149
SHA256

53ffc1d3fa63f21f7d3c28227be4fe592155c26dac5e89714559ca3c70a46ac7
SHA512

4c5d2d84880a82bee5a3d5a9d1e13018f682b43a7eba2adb710127d459ddbfee1899e0408e87b7319930d558ed08cbc6b89e4e116949124b251a749ef8b11aba
SSDEEP

1536:yukcny8tFRmcU5A0223gRtNasFywiE0qrybFz2e4Rmda7RQIG3pZ:yukUy+CA022Itpsfx6BRm2RNG5Z

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1668-0-0x0000000000400000-0x0000000000434000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1668	1a25ab1538022dc63b437734d1d1a58d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2872	1668	1a25ab1538022dc63b437734d1d1a58d_JaffaCakes118.exe	28
PID 1668 wrote to memory of 2872	1668	1a25ab1538022dc63b437734d1d1a58d_JaffaCakes118.exe	28
PID 1668 wrote to memory of 2872	1668	1a25ab1538022dc63b437734d1d1a58d_JaffaCakes118.exe	28
PID 1668 wrote to memory of 2872	1668	1a25ab1538022dc63b437734d1d1a58d_JaffaCakes118.exe	28
PID 1668 wrote to memory of 2872	1668	1a25ab1538022dc63b437734d1d1a58d_JaffaCakes118.exe	28
PID 1668 wrote to memory of 2872	1668	1a25ab1538022dc63b437734d1d1a58d_JaffaCakes118.exe	28
PID 1668 wrote to memory of 2872	1668	1a25ab1538022dc63b437734d1d1a58d_JaffaCakes118.exe	28

memory/1668-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1668-1-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1668-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1668-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2872-4-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/2872-3-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/2872-6-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/2872-9-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download