81b9ca5203f1341006833824c49f849ed27112a23238f4021db999dbc482f3c6

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 18:44

Target

35ef5cb7dea2e6aedcea855e04b48a03_JaffaCakes118.exe
Size

211KB
MD5

35ef5cb7dea2e6aedcea855e04b48a03
SHA1

c3c64ad9fc28dc503993fc21c8999e57299730fc
SHA256

81b9ca5203f1341006833824c49f849ed27112a23238f4021db999dbc482f3c6
SHA512

11f120f3da3cc9ac04dc3e2ed8ec9c0e0719b8f10487b7676fa5cf7b143e9f26ed7e97c55f4bc2b0d655934033f4aa7e9e7b7971947af09b07f2ecf12afd99b8
SSDEEP

1536:ZYrCaPvPNJGRcWA0ruHDZ2vDkcuZlb1vYlhKrKcjP1I7yenyNdT5adQZACwf6pm5:WrCa1JfWA0ijKUZr3wnaJgiZAC06Q7l

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2068-0-0x0000000000400000-0x0000000000436000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2068	35ef5cb7dea2e6aedcea855e04b48a03_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2072	2068	35ef5cb7dea2e6aedcea855e04b48a03_JaffaCakes118.exe	30
PID 2068 wrote to memory of 2072	2068	35ef5cb7dea2e6aedcea855e04b48a03_JaffaCakes118.exe	30
PID 2068 wrote to memory of 2072	2068	35ef5cb7dea2e6aedcea855e04b48a03_JaffaCakes118.exe	30
PID 2068 wrote to memory of 2072	2068	35ef5cb7dea2e6aedcea855e04b48a03_JaffaCakes118.exe	30
PID 2068 wrote to memory of 2072	2068	35ef5cb7dea2e6aedcea855e04b48a03_JaffaCakes118.exe	30
PID 2068 wrote to memory of 2072	2068	35ef5cb7dea2e6aedcea855e04b48a03_JaffaCakes118.exe	30
PID 2068 wrote to memory of 2072	2068	35ef5cb7dea2e6aedcea855e04b48a03_JaffaCakes118.exe	30

memory/2068-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2068-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2068-1-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/2068-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2068-6-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2072-7-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2072-4-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2072-3-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2072-8-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download