77dde5f49ab78e0954f6cd1effc8fded16e9f200ff81a86c12d7a4a881e2a1b8

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 00:18

Target

4768be8872df021e7e1a48b6574af7a5_JaffaCakes118.exe
Size

1.2MB
MD5

4768be8872df021e7e1a48b6574af7a5
SHA1

98c66fbca2593e52b362bdf1b38d91ce5760cd72
SHA256

77dde5f49ab78e0954f6cd1effc8fded16e9f200ff81a86c12d7a4a881e2a1b8
SHA512

0f15cc28d981c163a505130cd5ee70a3df9d344d0746419357a9eee97d2ccf8579f1dfd0d422dec4017da94535820180eb186ead34b43d6c321e71451ae45b1f
SSDEEP

24576:Rqf9cC3WSrAYod3Np1zwbhUpJEJdLZ2ivhygnP/7loi5c9UpzzKG6n:gfhWkAxdT1VpJEJdl2Ey+LSi5GUpzzcn

Score

7^/10

themida

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral1/memory/3024-8-0x0000000000400000-0x0000000000660000-memory.dmp	themida

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 1200	3024	4768be8872df021e7e1a48b6574af7a5_JaffaCakes118.exe	21
PID 3024 wrote to memory of 1200	3024	4768be8872df021e7e1a48b6574af7a5_JaffaCakes118.exe	21
PID 3024 wrote to memory of 1200	3024	4768be8872df021e7e1a48b6574af7a5_JaffaCakes118.exe	21
PID 3024 wrote to memory of 1200	3024	4768be8872df021e7e1a48b6574af7a5_JaffaCakes118.exe	21
PID 3024 wrote to memory of 1200	3024	4768be8872df021e7e1a48b6574af7a5_JaffaCakes118.exe	21
PID 3024 wrote to memory of 1200	3024	4768be8872df021e7e1a48b6574af7a5_JaffaCakes118.exe	21

memory/1200-5-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/1200-12-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/3024-1-0x0000000000310000-0x00000000003F3000-memory.dmp

Filesize
908KB

Download
memory/3024-0-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/3024-3-0x0000000000401000-0x0000000000408000-memory.dmp

Filesize
28KB

Download
memory/3024-2-0x0000000004260000-0x0000000004262000-memory.dmp

Filesize
8KB

Download
memory/3024-8-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download