0843c6df26193ca91ac105d9e556f79ebd7a3d37502ee1f825a709a6d917effe

Analysis

max time kernel
149s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 00:58

Target

4c28f25c8648074a8e2f857f4e18b82d_JaffaCakes118.exe
Size

239KB
MD5

4c28f25c8648074a8e2f857f4e18b82d
SHA1

73312a1acfb0e5b63f0238bfc43fdf31b407d830
SHA256

0843c6df26193ca91ac105d9e556f79ebd7a3d37502ee1f825a709a6d917effe
SHA512

34841311d70afe3a1bee08b72c5bf8c3828f232d53f2fca1d5013d1683face390363fa17fb6aa5bce9e73d6187fa17bfac305b82892978e820142303a747db05
SSDEEP

6144:z0TAOgKSAmM4mFi1muADPUpDWkmfGspYV:4LgKSAm0M8bspSGA

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2452-0-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2452-2-0x0000000000440000-0x000000000046B000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2452	4c28f25c8648074a8e2f857f4e18b82d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2064	2452	4c28f25c8648074a8e2f857f4e18b82d_JaffaCakes118.exe	29
PID 2452 wrote to memory of 2064	2452	4c28f25c8648074a8e2f857f4e18b82d_JaffaCakes118.exe	29
PID 2452 wrote to memory of 2064	2452	4c28f25c8648074a8e2f857f4e18b82d_JaffaCakes118.exe	29
PID 2452 wrote to memory of 2064	2452	4c28f25c8648074a8e2f857f4e18b82d_JaffaCakes118.exe	29
PID 2452 wrote to memory of 2064	2452	4c28f25c8648074a8e2f857f4e18b82d_JaffaCakes118.exe	29
PID 2452 wrote to memory of 2064	2452	4c28f25c8648074a8e2f857f4e18b82d_JaffaCakes118.exe	29
PID 2452 wrote to memory of 2064	2452	4c28f25c8648074a8e2f857f4e18b82d_JaffaCakes118.exe	29

memory/2064-4-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2064-5-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2064-8-0x0000000000840000-0x0000000000848000-memory.dmp

Filesize
32KB

Download
memory/2064-7-0x0000000000842000-0x0000000000843000-memory.dmp

Filesize
4KB

Download
memory/2452-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2452-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2452-2-0x0000000000440000-0x000000000046B000-memory.dmp

Filesize
172KB

Download
memory/2452-3-0x00000000001C0000-0x00000000001D4000-memory.dmp

Filesize
80KB

Download
memory/2452-6-0x00000000001C0000-0x00000000001D4000-memory.dmp

Filesize
80KB

Download