24110b4dd2ef5872d032f605de1e0abfad5cdc081d7fdef8c65bfe49acb25fb4

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 08:25

Target

48fcdc5521d71e860b1fa13b62ceeae7_JaffaCakes118.exe
Size

9KB
MD5

48fcdc5521d71e860b1fa13b62ceeae7
SHA1

ea40a93c23a685d28c82778ea6a3d371c0090684
SHA256

24110b4dd2ef5872d032f605de1e0abfad5cdc081d7fdef8c65bfe49acb25fb4
SHA512

f022145d3525c00d8548e3ca5b2ae32d46cd8f82f5f402efa733d79895ccda918f0ad9eeb2e19dc596a3a02c5e8ffadc4bbb85a0d49937a0e3e194b82559b3a4
SSDEEP

192:gQIs0mMglnsnhJHMNf8dGu7Br9ZCspE+TMIr3/bjOg+vtwJr/ja:gQIs0mMmnsnbHMB8QLeME/bjpa

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2812-0-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/2812-1-0x0000000000400000-0x0000000000407000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 2952	2812	48fcdc5521d71e860b1fa13b62ceeae7_JaffaCakes118.exe	31
PID 2812 wrote to memory of 2952	2812	48fcdc5521d71e860b1fa13b62ceeae7_JaffaCakes118.exe	31
PID 2812 wrote to memory of 2952	2812	48fcdc5521d71e860b1fa13b62ceeae7_JaffaCakes118.exe	31
PID 2812 wrote to memory of 2952	2812	48fcdc5521d71e860b1fa13b62ceeae7_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\48fcdc5521d71e860b1fa13b62ceeae7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\48fcdc5521d71e860b1fa13b62ceeae7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c PAUSE
  2⤵
  PID:2952

memory/2812-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2812-1-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download