17243b43cf2024a62b51a7c6657b0c4ea55eac22abd3e556f62c0e2db7c14684

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 05:49

Target

2f31269afff6899efed9753f6e4a5261_JaffaCakes118.exe
Size

79KB
MD5

2f31269afff6899efed9753f6e4a5261
SHA1

c9581ffb6a7729185f28820b3fb60454d9baf21c
SHA256

17243b43cf2024a62b51a7c6657b0c4ea55eac22abd3e556f62c0e2db7c14684
SHA512

c0c3878f647ef08ba09978fc71a7f5a1b6ad15162018543d697d3b51ce012cbcfce7f2a1f2fbcd33445c8cd0c007eede17a23d626baa9011b37ba23e03f93293
SSDEEP

1536:YzXUbJLMUK3+GiOb2uwp7d9uKQTBmh6MotqUSjq6h:YXiKli0e7D7x9G

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2080-0-0x0000000000400000-0x000000000041D000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2080	2f31269afff6899efed9753f6e4a5261_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 3764	2080	2f31269afff6899efed9753f6e4a5261_JaffaCakes118.exe	83
PID 2080 wrote to memory of 3764	2080	2f31269afff6899efed9753f6e4a5261_JaffaCakes118.exe	83
PID 2080 wrote to memory of 3764	2080	2f31269afff6899efed9753f6e4a5261_JaffaCakes118.exe	83
PID 2080 wrote to memory of 3764	2080	2f31269afff6899efed9753f6e4a5261_JaffaCakes118.exe	83
PID 2080 wrote to memory of 3764	2080	2f31269afff6899efed9753f6e4a5261_JaffaCakes118.exe	83

memory/2080-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2080-1-0x0000000000A10000-0x0000000000A12000-memory.dmp

Filesize
8KB

Download
memory/2080-2-0x0000000000A60000-0x0000000000A6E000-memory.dmp

Filesize
56KB

Download
memory/2080-3-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download