7a50722fe3e0b3507d1e953038c2074c16df292a14710f86e2de4fe63b10318c

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 21:54

Target

437deda81b62888dc35f50054b048f4a_JaffaCakes118.exe
Size

51KB
MD5

437deda81b62888dc35f50054b048f4a
SHA1

55b8d4f4669d427c3826e9753698bd96da5e478f
SHA256

7a50722fe3e0b3507d1e953038c2074c16df292a14710f86e2de4fe63b10318c
SHA512

ee3a6d78e7a14ddf2bc0c271e9d62362fc39fe049603b75c391b368ca284060d040e7d31921c72d1079ea6d468b1345580ed28e1ecbe1722bf0d4c49721b3746
SSDEEP

1536:8331QmQMTTm+O45oEZ1kdyYHNobvynouy8yAo:83lQm5TadmtZ1xYEioutyAo

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1040-0-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1040-3-0x0000000000400000-0x000000000041B000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1432	1040	WerFault.exe	29

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 1432	1040	437deda81b62888dc35f50054b048f4a_JaffaCakes118.exe	30
PID 1040 wrote to memory of 1432	1040	437deda81b62888dc35f50054b048f4a_JaffaCakes118.exe	30
PID 1040 wrote to memory of 1432	1040	437deda81b62888dc35f50054b048f4a_JaffaCakes118.exe	30
PID 1040 wrote to memory of 1432	1040	437deda81b62888dc35f50054b048f4a_JaffaCakes118.exe	30
PID 1040 wrote to memory of 1432	1040	437deda81b62888dc35f50054b048f4a_JaffaCakes118.exe	30
PID 1040 wrote to memory of 1432	1040	437deda81b62888dc35f50054b048f4a_JaffaCakes118.exe	30
PID 1040 wrote to memory of 1432	1040	437deda81b62888dc35f50054b048f4a_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\437deda81b62888dc35f50054b048f4a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\437deda81b62888dc35f50054b048f4a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 252
  2⤵
  - Program crash
  PID:1432

memory/1040-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1040-2-0x0000000000020000-0x000000000003B000-memory.dmp

Filesize
108KB

Download
memory/1040-1-0x0000000000020000-0x000000000003B000-memory.dmp

Filesize
108KB

Download
memory/1040-3-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1040-5-0x0000000000020000-0x000000000003B000-memory.dmp

Filesize
108KB

Download