e310b1133c509ff38d082703a05a20a72b61f195dd2d638d14aee476a6ffec00

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 01:37

Target

37386c0355af1c4f498048a7c420ac2b_JaffaCakes118.exe
Size

11KB
MD5

37386c0355af1c4f498048a7c420ac2b
SHA1

f6291ea39b4eaeb99a61b713ba677b7356776daa
SHA256

e310b1133c509ff38d082703a05a20a72b61f195dd2d638d14aee476a6ffec00
SHA512

af465bc9876beaa38db2efc27ed43c577772b6476ea830ebf899c7f0f5a918b24580ebcd2b9c53e48ea6089f9a7bad8e87225e8a1574eaaf38e77d0fbc31b028
SSDEEP

192:OCsSBbaQMEnRVWe3vJyr2lsMsaxBy/Ti+1MNmCqO4hlEXyHeLdCbQc+n:JHavEnl3vJa2uuoFqPAh6CH4Ke

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2280-0-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1860	2280	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 1860	2280	37386c0355af1c4f498048a7c420ac2b_JaffaCakes118.exe	31
PID 2280 wrote to memory of 1860	2280	37386c0355af1c4f498048a7c420ac2b_JaffaCakes118.exe	31
PID 2280 wrote to memory of 1860	2280	37386c0355af1c4f498048a7c420ac2b_JaffaCakes118.exe	31
PID 2280 wrote to memory of 1860	2280	37386c0355af1c4f498048a7c420ac2b_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\37386c0355af1c4f498048a7c420ac2b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\37386c0355af1c4f498048a7c420ac2b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 88
  2⤵
  - Program crash
  PID:1860

memory/2280-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download