c36d199b88c6e9cbd9ee246a17e54c2213304fc41d09cf3aefe4b58bdade84d1

Analysis

max time kernel
138s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 16:44

Target

358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe
Size

83KB
MD5

358cbe1a2eae994300bd6a0bf4af81e1
SHA1

bdf6dab7ab2686c7a3606d9f9a0b2568006aa830
SHA256

c36d199b88c6e9cbd9ee246a17e54c2213304fc41d09cf3aefe4b58bdade84d1
SHA512

b90a0567f0dfc1953b93c56b3f3bf70b8595db30d379f6d0f9e04084ddc82b46e02057bad881f8aa7d181bc72ef928d54d6f47125327d4e8d3db8337105fcca2
SSDEEP

1536:cXT0oDANjN7LiZ1aEkmKGKgE64XDfoyiwN7D9phG:u0OAN9Q1Rc6DwNP9phG

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4924-0-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral2/memory/4924-9-0x0000000000400000-0x000000000043C000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4924 set thread context of 2212	4924	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	83

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2212	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe
2212	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe
2212	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe
2212	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4924	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 2212	4924	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	83
PID 4924 wrote to memory of 2212	4924	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	83
PID 4924 wrote to memory of 2212	4924	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	83
PID 4924 wrote to memory of 2212	4924	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	83
PID 4924 wrote to memory of 2212	4924	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	83
PID 4924 wrote to memory of 2212	4924	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	83
PID 4924 wrote to memory of 2212	4924	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	83
PID 2212 wrote to memory of 3548	2212	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	56
PID 2212 wrote to memory of 3548	2212	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	56
PID 2212 wrote to memory of 3548	2212	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	56
PID 2212 wrote to memory of 3548	2212	358cbe1a2eae994300bd6a0bf4af81e1_JaffaCakes118.exe	56

memory/2212-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2212-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2212-6-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2212-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3548-10-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3548-11-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/4924-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4924-9-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download