c36d199b88c6e9cbd9ee246a17e54c2213304fc41d09cf3aefe4b58bdade84d1

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 16:44

Target

358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe
Size

83KB
MD5

358cbe1a2eae994300bd6a0bf4af81e1
SHA1

bdf6dab7ab2686c7a3606d9f9a0b2568006aa830
SHA256

c36d199b88c6e9cbd9ee246a17e54c2213304fc41d09cf3aefe4b58bdade84d1
SHA512

b90a0567f0dfc1953b93c56b3f3bf70b8595db30d379f6d0f9e04084ddc82b46e02057bad881f8aa7d181bc72ef928d54d6f47125327d4e8d3db8337105fcca2
SSDEEP

1536:cXT0oDANjN7LiZ1aEkmKGKgE64XDfoyiwN7D9phG:u0OAN9Q1Rc6DwNP9phG

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2252-0-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/2252-10-0x0000000000400000-0x000000000043C000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2252 set thread context of 2704	2252	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2704	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe
2704	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2252	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2704	2252	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	30
PID 2252 wrote to memory of 2704	2252	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	30
PID 2252 wrote to memory of 2704	2252	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	30
PID 2252 wrote to memory of 2704	2252	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	30
PID 2252 wrote to memory of 2704	2252	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	30
PID 2252 wrote to memory of 2704	2252	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	30
PID 2252 wrote to memory of 2704	2252	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	30
PID 2252 wrote to memory of 2704	2252	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	30
PID 2704 wrote to memory of 1192	2704	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	21
PID 2704 wrote to memory of 1192	2704	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	21
PID 2704 wrote to memory of 1192	2704	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	21
PID 2704 wrote to memory of 1192	2704	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	21

memory/1192-11-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1192-14-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2252-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2252-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2252-6-0x00000000003B0000-0x00000000003EC000-memory.dmp

Filesize
240KB

Download
memory/2704-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2704-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2704-7-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2704-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download