214f8a60a870557074fdb4872f343543995a8a5fa1468c30d5a46ea21c90d9f3

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 21:20

Target

2dd6d9e6bc50e0bd48dc6f95177888d8_JaffaCakes118.exe
Size

425KB
MD5

2dd6d9e6bc50e0bd48dc6f95177888d8
SHA1

e0bda22c31b975ba8e3c80becbf4f39844eab41b
SHA256

214f8a60a870557074fdb4872f343543995a8a5fa1468c30d5a46ea21c90d9f3
SHA512

a9b585d913db726a464e5c5175d0a9db5effabbe4ee21c8d18a4539b5616af9ff036ace54ef9fca5cfbadc98c6d9923caa43ae1092b664d4846422e4dae1cde1
SSDEEP

6144:nMzzILGFkzhr0pGj9oUukmeBt1u8Pljd6Z587pqDjkxCqSsQLH5AE:HcoqGj9oUjmeBt1FPlQZIs5qSsPE

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2524-0-0x0000000000400000-0x00000000004D4000-memory.dmp	upx
behavioral1/memory/2524-1-0x0000000000400000-0x00000000004D4000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2092	2524	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2092	2524	2dd6d9e6bc50e0bd48dc6f95177888d8_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2092	2524	2dd6d9e6bc50e0bd48dc6f95177888d8_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2092	2524	2dd6d9e6bc50e0bd48dc6f95177888d8_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2092	2524	2dd6d9e6bc50e0bd48dc6f95177888d8_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\2dd6d9e6bc50e0bd48dc6f95177888d8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2dd6d9e6bc50e0bd48dc6f95177888d8_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 88
  2⤵
  - Program crash
  PID:2092

memory/2524-0-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2524-1-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download