4c242f8db354c4d978df0c1afc77fd6c6f823d1bbb80b317b30b4e5e31226c05

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 02:28

Target

32f9198d8510f886fc4ac26baa6a1fbe_JaffaCakes118.exe
Size

210KB
MD5

32f9198d8510f886fc4ac26baa6a1fbe
SHA1

44c91863695a9165df4d4be47ece0723d70a0b6b
SHA256

4c242f8db354c4d978df0c1afc77fd6c6f823d1bbb80b317b30b4e5e31226c05
SHA512

84c2f45ab4bf3ecacb45a555878163cc483d93298e571b1e99145c5c278406e3f26f58d78c4669db8d39c7669823e1abb2af12f6a147032b9985ad1d8185b1ae
SSDEEP

1536:kOC0FvV4OguHxjhpA4Bm7uW0vSUsghQevBFkutIbgTuFqKRr0aF5frleGhd9TfBK:kwV4OgSzBmh04eZFkz3Rr0gwGj9Tf8V

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1724-0-0x0000000000400000-0x0000000000475000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1104	1724	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1104	1724	32f9198d8510f886fc4ac26baa6a1fbe_JaffaCakes118.exe	30
PID 1724 wrote to memory of 1104	1724	32f9198d8510f886fc4ac26baa6a1fbe_JaffaCakes118.exe	30
PID 1724 wrote to memory of 1104	1724	32f9198d8510f886fc4ac26baa6a1fbe_JaffaCakes118.exe	30
PID 1724 wrote to memory of 1104	1724	32f9198d8510f886fc4ac26baa6a1fbe_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\32f9198d8510f886fc4ac26baa6a1fbe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\32f9198d8510f886fc4ac26baa6a1fbe_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 88
  2⤵
  - Program crash
  PID:1104

memory/1724-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download