7d6bcaf85f25225e8bc58f7267cf93e8e45705e21a8d1032166f235d745dec30

Analysis

max time kernel
141s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 00:23

Target

36ffffbbc452d312465685761e1666f2_JaffaCakes118.exe
Size

4KB
MD5

36ffffbbc452d312465685761e1666f2
SHA1

fda2261fc3d5933d83d42cf41768af6cc5af9f19
SHA256

7d6bcaf85f25225e8bc58f7267cf93e8e45705e21a8d1032166f235d745dec30
SHA512

6d505c92cc0f99c07888a4559f28864204a30f56e6ab344cbe8a16338e54ea88dcf13ba7533ee3a95aa4d8a765110c803e28a76b8e155a770e3b1ad7edc80c0c
SSDEEP

96:ftJ9j5kNUMdmMgl9tKs9isQBhZHgaqyQKQNTR:9almMglnKYisGhZHgaZuNTR

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2052-0-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/2052-1-0x0000000000400000-0x0000000000407000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 4208	2052	36ffffbbc452d312465685761e1666f2_JaffaCakes118.exe	84
PID 2052 wrote to memory of 4208	2052	36ffffbbc452d312465685761e1666f2_JaffaCakes118.exe	84
PID 2052 wrote to memory of 4208	2052	36ffffbbc452d312465685761e1666f2_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\36ffffbbc452d312465685761e1666f2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\36ffffbbc452d312465685761e1666f2_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c PAUSE
  2⤵
  PID:4208

memory/2052-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2052-1-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download