8b89ed0db66936f8bb498fabcecd897ef9dea40250e0f6acc436699a79512804

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 10:31

Target

49666e1780b00aee041283aaace97142_JaffaCakes118.exe
Size

300KB
MD5

49666e1780b00aee041283aaace97142
SHA1

4812e9a334ac2c0e1f918ba648d4bdaf8f2c93d5
SHA256

8b89ed0db66936f8bb498fabcecd897ef9dea40250e0f6acc436699a79512804
SHA512

ba215f3761dbfe8bda453af66596bd2c31c7f8a13787e9cd7ea84af790a706622fcf2749bd9fe78137f2bf598afc8ce9b643250f448fb0cdd8e793396a8d61cb
SSDEEP

6144:knsd1jUrCQaFDDUAMnAWIOS47gIFzA92htyxiQQy1ZDKem3qA:knCjU+NFntulIYM2A9GVQQyfDpm3

Score

7^/10

themida

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral2/memory/5104-0-0x0000000000400000-0x00000000005051F8-memory.dmp	themida
behavioral2/memory/5104-1-0x0000000000400000-0x00000000005051F8-memory.dmp	themida
behavioral2/memory/5104-2-0x0000000000400000-0x00000000005051F8-memory.dmp	themida
behavioral2/memory/5104-3-0x0000000000400000-0x00000000005051F8-memory.dmp	themida
behavioral2/memory/5104-4-0x0000000000400000-0x00000000005051F8-memory.dmp	themida
behavioral2/memory/5104-7-0x0000000000400000-0x00000000005051F8-memory.dmp	themida

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\QQ.exe	49666e1780b00aee041283aaace97142_JaffaCakes118.exe
File opened for modification	C:\Windows\QQ.exe	49666e1780b00aee041283aaace97142_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 3984	5104	49666e1780b00aee041283aaace97142_JaffaCakes118.exe	86
PID 5104 wrote to memory of 3984	5104	49666e1780b00aee041283aaace97142_JaffaCakes118.exe	86
PID 5104 wrote to memory of 3984	5104	49666e1780b00aee041283aaace97142_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\49666e1780b00aee041283aaace97142_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\49666e1780b00aee041283aaace97142_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c del /F "C:\Users\Admin\AppData\Local\Temp\49666e1780b00aee041283aaace97142_JaffaCakes118.exe"
  2⤵
  PID:3984

memory/5104-0-0x0000000000400000-0x00000000005051F8-memory.dmp

Filesize
1.0MB

Download
memory/5104-1-0x0000000000400000-0x00000000005051F8-memory.dmp

Filesize
1.0MB

Download
memory/5104-2-0x0000000000400000-0x00000000005051F8-memory.dmp

Filesize
1.0MB

Download
memory/5104-3-0x0000000000400000-0x00000000005051F8-memory.dmp

Filesize
1.0MB

Download
memory/5104-4-0x0000000000400000-0x00000000005051F8-memory.dmp

Filesize
1.0MB

Download
memory/5104-6-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/5104-7-0x0000000000400000-0x00000000005051F8-memory.dmp

Filesize
1.0MB

Download