0b10941fbc30bc937260d7f4ab45595dd601372ed5fbae47aef6ba6ba08f6085

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 09:16

Target

2fc8fc96d42611ce3245aab84c65911f_JaffaCakes118.exe
Size

76KB
MD5

2fc8fc96d42611ce3245aab84c65911f
SHA1

e21270d498f8a3a6b33d28bc8dc53ff483b0365d
SHA256

0b10941fbc30bc937260d7f4ab45595dd601372ed5fbae47aef6ba6ba08f6085
SHA512

7efa27c2a7b032adb3e20b7845771c19bdc8831680e0a3f01043de246e7686afcf18d3d23b8172a0c3df96353c0165edb717a4e34308680918501cd7e14075e3
SSDEEP

1536:CXbXg/Pg3I+tbMq1xJK9gRA2NxqmBadt7DK1:4EPoTgqJK2A2N2jPk

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3644-0-0x0000000001000000-0x000000000101F000-memory.dmp	upx
behavioral2/memory/3644-9-0x0000000001000000-0x000000000101F000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3644 set thread context of 4644	3644	2fc8fc96d42611ce3245aab84c65911f_JaffaCakes118.exe	84

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\KB32893.tmp	2fc8fc96d42611ce3245aab84c65911f_JaffaCakes118.exe
File opened for modification	C:\Windows\KB32893.tmp	2fc8fc96d42611ce3245aab84c65911f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4644	2fc8fc96d42611ce3245aab84c65911f_JaffaCakes118.exe
4644	2fc8fc96d42611ce3245aab84c65911f_JaffaCakes118.exe
4644	2fc8fc96d42611ce3245aab84c65911f_JaffaCakes118.exe
4644	2fc8fc96d42611ce3245aab84c65911f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 4644	3644	2fc8fc96d42611ce3245aab84c65911f_JaffaCakes118.exe	84
PID 3644 wrote to memory of 4644	3644	2fc8fc96d42611ce3245aab84c65911f_JaffaCakes118.exe	84
PID 3644 wrote to memory of 4644	3644	2fc8fc96d42611ce3245aab84c65911f_JaffaCakes118.exe	84
PID 3644 wrote to memory of 4644	3644	2fc8fc96d42611ce3245aab84c65911f_JaffaCakes118.exe	84
PID 3644 wrote to memory of 4644	3644	2fc8fc96d42611ce3245aab84c65911f_JaffaCakes118.exe	84
PID 3644 wrote to memory of 4644	3644	2fc8fc96d42611ce3245aab84c65911f_JaffaCakes118.exe	84
PID 3644 wrote to memory of 4644	3644	2fc8fc96d42611ce3245aab84c65911f_JaffaCakes118.exe	84
PID 4644 wrote to memory of 3388	4644	2fc8fc96d42611ce3245aab84c65911f_JaffaCakes118.exe	56
PID 4644 wrote to memory of 3388	4644	2fc8fc96d42611ce3245aab84c65911f_JaffaCakes118.exe	56
PID 4644 wrote to memory of 3388	4644	2fc8fc96d42611ce3245aab84c65911f_JaffaCakes118.exe	56
PID 4644 wrote to memory of 3388	4644	2fc8fc96d42611ce3245aab84c65911f_JaffaCakes118.exe	56

memory/3388-11-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3388-12-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3644-0-0x0000000001000000-0x000000000101F000-memory.dmp

Filesize
124KB

Download
memory/3644-9-0x0000000001000000-0x000000000101F000-memory.dmp

Filesize
124KB

Download
memory/4644-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4644-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4644-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4644-10-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4644-15-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download