52b4b47ada8ed8f45aae0ed6f7ae345591d10d2579d40b28822b07c60b46579e

Analysis

max time kernel
93s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06-07-2024 10:52

Target

284802692c6b4ad8d8189ed651316934_JaffaCakes118.exe
Size

91KB
MD5

284802692c6b4ad8d8189ed651316934
SHA1

adba6eca7b1e54ff45abf7eacc558d8cafbbea08
SHA256

52b4b47ada8ed8f45aae0ed6f7ae345591d10d2579d40b28822b07c60b46579e
SHA512

3ae42fc674cb256c2937646ee3431ab8bce44c580320e2ee456ba774a64fb75e4969ba7d980dd8e8570ed29072f4c6bf8232bb27b473696b68ce1d7ddab358bd
SSDEEP

1536:0sQMHXQaTxQvB/HkI+HJplxA1/lGmZ0pK22k5TX4PpgaUaz62gFEwm3x0qyNL+gu:0M3TxQvdkI+HJpnA1dGmZ0pK2XTGZJnv

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2004-0-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/2004-5-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2004 set thread context of 2572	2004	284802692c6b4ad8d8189ed651316934_JaffaCakes118.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2612	2572	WerFault.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2004	284802692c6b4ad8d8189ed651316934_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2572	2004	284802692c6b4ad8d8189ed651316934_JaffaCakes118.exe	82
PID 2004 wrote to memory of 2572	2004	284802692c6b4ad8d8189ed651316934_JaffaCakes118.exe	82
PID 2004 wrote to memory of 2572	2004	284802692c6b4ad8d8189ed651316934_JaffaCakes118.exe	82
PID 2004 wrote to memory of 2572	2004	284802692c6b4ad8d8189ed651316934_JaffaCakes118.exe	82
PID 2004 wrote to memory of 2572	2004	284802692c6b4ad8d8189ed651316934_JaffaCakes118.exe	82
PID 2004 wrote to memory of 2572	2004	284802692c6b4ad8d8189ed651316934_JaffaCakes118.exe	82
PID 2004 wrote to memory of 2572	2004	284802692c6b4ad8d8189ed651316934_JaffaCakes118.exe	82
PID 2004 wrote to memory of 2572	2004	284802692c6b4ad8d8189ed651316934_JaffaCakes118.exe	82
PID 2004 wrote to memory of 2572	2004	284802692c6b4ad8d8189ed651316934_JaffaCakes118.exe	82
PID 2004 wrote to memory of 2572	2004	284802692c6b4ad8d8189ed651316934_JaffaCakes118.exe	82

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2572 -ip 2572
1⤵
PID:3584

memory/2004-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2004-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2572-3-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download