fbf394aa38a544af667d6f8ff2c5ae655335b863fbd3bc9f29f17034037f8625

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 13:34

Target

4609a1fd225b1170f06c8c52f00caead_JaffaCakes118.exe
Size

165KB
MD5

4609a1fd225b1170f06c8c52f00caead
SHA1

b622c9090f7377492f2eb8a5dc2439da0b4de7fe
SHA256

fbf394aa38a544af667d6f8ff2c5ae655335b863fbd3bc9f29f17034037f8625
SHA512

d28ccddf2647fdaabe5a68f52b0f452d2ad524d7545e9606262addb3d0b80efd4ecdecb5fd4f6c34344bbfd39ac7181925c604756280bab3b55a320e827f0ebf
SSDEEP

3072:vE7MPKkTWd7TyXA05h60EvNb3k06MOepRhc8DdiDqT/:vE74KYWRo40E5KMOepzDHT

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/404-0-0x0000000000400000-0x000000000042B000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
404	4609a1fd225b1170f06c8c52f00caead_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 3468	404	4609a1fd225b1170f06c8c52f00caead_JaffaCakes118.exe	56
PID 404 wrote to memory of 3468	404	4609a1fd225b1170f06c8c52f00caead_JaffaCakes118.exe	56

memory/404-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/404-1-0x00000000001D0000-0x00000000001E0000-memory.dmp

Filesize
64KB

Download
memory/404-2-0x0000000000500000-0x000000000051A000-memory.dmp

Filesize
104KB

Download
memory/404-4-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/404-3-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download