4283508de707a388f267b7b4e449ccd8bd000433b78f61d0fa6ab8edbd279ffc

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 11:48

Target

45ae52d4f77c740e0f5c867e90861c47_JaffaCakes118.exe
Size

21KB
MD5

45ae52d4f77c740e0f5c867e90861c47
SHA1

d9d7f857b8d6506d560bf0ab8c070adc6a49a8c2
SHA256

4283508de707a388f267b7b4e449ccd8bd000433b78f61d0fa6ab8edbd279ffc
SHA512

56e1e249cb6d6beaf1c246e2c9f87fbe32640c1828fbcc4f60f2697e7ffc1c9f1f4b5b9c26b311566ec35d820318827960285ffc27836fc5f72e58afad25a658
SSDEEP

192:1Sxv2RkKihvYcmrnlnhQzC5almMglnKYisGhZH0JhM0:1qalnhQ++mMmnKnDrH0B

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2888-0-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/2888-1-0x0000000000400000-0x0000000000407000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 5104	2888	45ae52d4f77c740e0f5c867e90861c47_JaffaCakes118.exe	86
PID 2888 wrote to memory of 5104	2888	45ae52d4f77c740e0f5c867e90861c47_JaffaCakes118.exe	86
PID 2888 wrote to memory of 5104	2888	45ae52d4f77c740e0f5c867e90861c47_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\45ae52d4f77c740e0f5c867e90861c47_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\45ae52d4f77c740e0f5c867e90861c47_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c PAUSE
  2⤵
  PID:5104

memory/2888-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2888-1-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download