b3f60d6c754ebd249472a306d997e7be1dbffdb2d7b2505e402aebbb1fc9328e

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 17:46

Target

3a23fa16b30c7e1429f2f8faa040bfeb_JaffaCakes118.exe
Size

68KB
MD5

3a23fa16b30c7e1429f2f8faa040bfeb
SHA1

2858fa07a1b96150af666bf51a652a5afeefc3fb
SHA256

b3f60d6c754ebd249472a306d997e7be1dbffdb2d7b2505e402aebbb1fc9328e
SHA512

58ff80619bd395fec6ed0ab00d3cc2c58373c43da0972015bf38e40c2e64619c85192cd47714de29c6d720f6583c1616c52c4e332a87b41a865806a38b406477
SSDEEP

1536:hvOTKa+oFDEoNFMMyp71LdE1KGYxuu8jtlwgOa6ARtA:hvqKwDXfMMyhEbuPgOa6ARtA

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3032-0-0x0000000000400000-0x000000000041A000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3032	3a23fa16b30c7e1429f2f8faa040bfeb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2796	3032	3a23fa16b30c7e1429f2f8faa040bfeb_JaffaCakes118.exe	30
PID 3032 wrote to memory of 2796	3032	3a23fa16b30c7e1429f2f8faa040bfeb_JaffaCakes118.exe	30
PID 3032 wrote to memory of 2796	3032	3a23fa16b30c7e1429f2f8faa040bfeb_JaffaCakes118.exe	30
PID 3032 wrote to memory of 2796	3032	3a23fa16b30c7e1429f2f8faa040bfeb_JaffaCakes118.exe	30
PID 3032 wrote to memory of 2796	3032	3a23fa16b30c7e1429f2f8faa040bfeb_JaffaCakes118.exe	30
PID 3032 wrote to memory of 2796	3032	3a23fa16b30c7e1429f2f8faa040bfeb_JaffaCakes118.exe	30
PID 3032 wrote to memory of 2796	3032	3a23fa16b30c7e1429f2f8faa040bfeb_JaffaCakes118.exe	30

memory/2796-4-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2796-3-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2796-6-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2796-9-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/3032-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3032-1-0x00000000002B0000-0x00000000002B2000-memory.dmp

Filesize
8KB

Download
memory/3032-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3032-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download