dc93b529ba9f1bc85aca3ffdea669b3af9c73e4aab4394ebf9e652fda15f99ce

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 13:05

Target

45f0a09a585ecad958ca72f04fd4ffe3_JaffaCakes118.exe
Size

1.2MB
MD5

45f0a09a585ecad958ca72f04fd4ffe3
SHA1

f87630373e3074b418ca74aa8101c3258234c3f9
SHA256

dc93b529ba9f1bc85aca3ffdea669b3af9c73e4aab4394ebf9e652fda15f99ce
SHA512

39a7a98c024a7d6c3e6987bae2875bb9f3bd478be8b8e7f053dc70ca1031489ce8cecf7c5df46d5874827e4b0a0224edcbff53f4a0b654510d00fc3eec098d51
SSDEEP

24576:kf0cPEwjhYnRRXyIJL9PYa5R2QU9L40j5oqAhl069zCtmipjwdRhxbn:kbPE8inLXyI19gAU97AhB9zAmajwnx

Score

7^/10

themida

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral1/memory/2288-4-0x0000000000400000-0x0000000000666000-memory.dmp	themida

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2288	45f0a09a585ecad958ca72f04fd4ffe3_JaffaCakes118.exe
2288	45f0a09a585ecad958ca72f04fd4ffe3_JaffaCakes118.exe
2288	45f0a09a585ecad958ca72f04fd4ffe3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 1228	2288	45f0a09a585ecad958ca72f04fd4ffe3_JaffaCakes118.exe	21
PID 2288 wrote to memory of 1228	2288	45f0a09a585ecad958ca72f04fd4ffe3_JaffaCakes118.exe	21
PID 2288 wrote to memory of 1228	2288	45f0a09a585ecad958ca72f04fd4ffe3_JaffaCakes118.exe	21
PID 2288 wrote to memory of 1228	2288	45f0a09a585ecad958ca72f04fd4ffe3_JaffaCakes118.exe	21
PID 2288 wrote to memory of 1228	2288	45f0a09a585ecad958ca72f04fd4ffe3_JaffaCakes118.exe	21
PID 2288 wrote to memory of 1228	2288	45f0a09a585ecad958ca72f04fd4ffe3_JaffaCakes118.exe	21

memory/1228-5-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/1228-11-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/2288-0-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2288-1-0x00000000002F0000-0x00000000003DC000-memory.dmp

Filesize
944KB

Download
memory/2288-2-0x0000000004270000-0x0000000004272000-memory.dmp

Filesize
8KB

Download
memory/2288-3-0x0000000000401000-0x0000000000408000-memory.dmp

Filesize
28KB

Download
memory/2288-4-0x0000000000400000-0x0000000000666000-memory.dmp

Filesize
2.4MB

Download