1d1eafd82bc04963b6529d9afe01365e9af7d6b0edd377e1a8a4db0762cde5cd

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 11:16

Target

2c1f15f80b1e513bb80c4a3a78d79744_JaffaCakes118.exe
Size

107KB
MD5

2c1f15f80b1e513bb80c4a3a78d79744
SHA1

ec9c6046c0c603cfe4e7f78e88099a11cb77f023
SHA256

1d1eafd82bc04963b6529d9afe01365e9af7d6b0edd377e1a8a4db0762cde5cd
SHA512

ecb2ecae2e542992588b197db1230eed2e6e0a15be346536f027b2f00f38d9d8232ddc2b440ade1e7bb7c4c5f45f7aab1d6ea71577e5a2b0a8b42d33a9af5e3e
SSDEEP

3072:PorXhVTwi5Dg55dady2tgLLtmhZf/NKbCbnPXdu:Pq84DgUJWSOmLg

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1964-0-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 3060	1964	2c1f15f80b1e513bb80c4a3a78d79744_JaffaCakes118.exe	30
PID 1964 wrote to memory of 3060	1964	2c1f15f80b1e513bb80c4a3a78d79744_JaffaCakes118.exe	30
PID 1964 wrote to memory of 3060	1964	2c1f15f80b1e513bb80c4a3a78d79744_JaffaCakes118.exe	30
PID 1964 wrote to memory of 3060	1964	2c1f15f80b1e513bb80c4a3a78d79744_JaffaCakes118.exe	30
PID 1964 wrote to memory of 3060	1964	2c1f15f80b1e513bb80c4a3a78d79744_JaffaCakes118.exe	30
PID 1964 wrote to memory of 3060	1964	2c1f15f80b1e513bb80c4a3a78d79744_JaffaCakes118.exe	30
PID 1964 wrote to memory of 3060	1964	2c1f15f80b1e513bb80c4a3a78d79744_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\2c1f15f80b1e513bb80c4a3a78d79744_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c1f15f80b1e513bb80c4a3a78d79744_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:3060

memory/1964-1-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/1964-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1964-2-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1964-5-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3060-4-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/3060-3-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/3060-7-0x0000000000210000-0x0000000000218000-memory.dmp

Filesize
32KB

Download
memory/3060-6-0x0000000000212000-0x0000000000213000-memory.dmp

Filesize
4KB

Download