fda1c1480ca95c50840d3d40c8f6231fe451e11002131c73b9d8009901d58de3

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 10:30

Target

345bd0ed1a68afbd63b1ad4a56870f74_JaffaCakes118.exe
Size

1.1MB
MD5

345bd0ed1a68afbd63b1ad4a56870f74
SHA1

828082436ae2238d19208767fe2c81f385284a9c
SHA256

fda1c1480ca95c50840d3d40c8f6231fe451e11002131c73b9d8009901d58de3
SHA512

544fc1d5d08eb7cb87798224a8f2a83f903c7970b42ee6a7cd5cbd7ae38cb04326bb47e412215379f2bb3486d634ad3a31e25f30936a310f5e59ef1c6ffca638
SSDEEP

24576:EHplcbinIq8uXuxIQRda3ixSeq9BzanicjfycIHByd84ys2dfE6HiC7H8:EHplcbinIq8uXu2DixM9BObz7IhyS4y+

Score

7^/10

themida

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral1/memory/2536-8-0x0000000000400000-0x0000000000645000-memory.dmp	themida

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2536	345bd0ed1a68afbd63b1ad4a56870f74_JaffaCakes118.exe
2536	345bd0ed1a68afbd63b1ad4a56870f74_JaffaCakes118.exe
2536	345bd0ed1a68afbd63b1ad4a56870f74_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 1196	2536	345bd0ed1a68afbd63b1ad4a56870f74_JaffaCakes118.exe	21
PID 2536 wrote to memory of 1196	2536	345bd0ed1a68afbd63b1ad4a56870f74_JaffaCakes118.exe	21
PID 2536 wrote to memory of 1196	2536	345bd0ed1a68afbd63b1ad4a56870f74_JaffaCakes118.exe	21
PID 2536 wrote to memory of 1196	2536	345bd0ed1a68afbd63b1ad4a56870f74_JaffaCakes118.exe	21
PID 2536 wrote to memory of 1196	2536	345bd0ed1a68afbd63b1ad4a56870f74_JaffaCakes118.exe	21
PID 2536 wrote to memory of 1196	2536	345bd0ed1a68afbd63b1ad4a56870f74_JaffaCakes118.exe	21

memory/1196-3-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/1196-12-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/2536-0-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2536-1-0x0000000001F10000-0x0000000001FED000-memory.dmp

Filesize
884KB

Download
memory/2536-6-0x0000000004240000-0x0000000004242000-memory.dmp

Filesize
8KB

Download
memory/2536-7-0x0000000000401000-0x0000000000408000-memory.dmp

Filesize
28KB

Download
memory/2536-8-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download