cf9bb3a6ed055d00467c8d767f02cd0e903ca427d1b751a56bb8cac01bdbf227

Analysis

max time kernel
125s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 14:22

Target

1ba0d4d47428f3818093a81c8ba4cbd6_JaffaCakes118.exe
Size

84KB
MD5

1ba0d4d47428f3818093a81c8ba4cbd6
SHA1

4838c7ce64ff42a9558d023d579dd2b5b1dc109a
SHA256

cf9bb3a6ed055d00467c8d767f02cd0e903ca427d1b751a56bb8cac01bdbf227
SHA512

85de71ab723d376848d8b634bb7b0180324b359a64e11e1a9bf5fd4c08f920dc920567dbfba67ea41b19d7e6b2b77ee3f00f0e52608ac49686c671e2f5f01699
SSDEEP

1536:vKxZdumDSmvH1c4iDrRMFAYPqFemoJCzV5G3DjrMQ7jEuWG1aeYENa3IwVDrM3:vKdum+uH1XDgemFvODE84FvSNaYwVrk

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3204-0-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3204	1ba0d4d47428f3818093a81c8ba4cbd6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 1392	3204	1ba0d4d47428f3818093a81c8ba4cbd6_JaffaCakes118.exe	89
PID 3204 wrote to memory of 1392	3204	1ba0d4d47428f3818093a81c8ba4cbd6_JaffaCakes118.exe	89
PID 3204 wrote to memory of 1392	3204	1ba0d4d47428f3818093a81c8ba4cbd6_JaffaCakes118.exe	89
PID 3204 wrote to memory of 1392	3204	1ba0d4d47428f3818093a81c8ba4cbd6_JaffaCakes118.exe	89
PID 3204 wrote to memory of 1392	3204	1ba0d4d47428f3818093a81c8ba4cbd6_JaffaCakes118.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4256,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:8
1⤵
PID:3620

memory/3204-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3204-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3204-4-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3204-3-0x00000000020E0000-0x00000000020EE000-memory.dmp

Filesize
56KB

Download
memory/3204-1-0x0000000002050000-0x0000000002052000-memory.dmp

Filesize
8KB

Download