d4ffcd751cf2f74c39a0c6e2730a902a737cbefe672038fe2eb142eeb9e142dc

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 11:13

Target

4e0ebebf4bd1c14af0562fdd1ef3eb09_JaffaCakes118.exe
Size

77KB
MD5

4e0ebebf4bd1c14af0562fdd1ef3eb09
SHA1

fdb16a4bd0d44422962dd49e6d3a7c49e0532cba
SHA256

d4ffcd751cf2f74c39a0c6e2730a902a737cbefe672038fe2eb142eeb9e142dc
SHA512

b19c2226da9bf85bc0a439713b53b329e20b43392f07b3b6b88f23d5e763ba66227586c4ee1f229d3d4ce9fc493d25d388081095f8ae494690bf35ad10e29451
SSDEEP

1536:JXfLPxCjo9WyQ7f0ItBrydwS9GUwaTXt3lCqepYEyoj:JXTQU5kf0Izyp9GUNt3lCqepL

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2644-0-0x0000000000400000-0x000000000041B000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2644	4e0ebebf4bd1c14af0562fdd1ef3eb09_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2668	2644	4e0ebebf4bd1c14af0562fdd1ef3eb09_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2668	2644	4e0ebebf4bd1c14af0562fdd1ef3eb09_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2668	2644	4e0ebebf4bd1c14af0562fdd1ef3eb09_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2668	2644	4e0ebebf4bd1c14af0562fdd1ef3eb09_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2668	2644	4e0ebebf4bd1c14af0562fdd1ef3eb09_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2668	2644	4e0ebebf4bd1c14af0562fdd1ef3eb09_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2668	2644	4e0ebebf4bd1c14af0562fdd1ef3eb09_JaffaCakes118.exe	30

memory/2644-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2644-1-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2644-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2644-4-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2668-6-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/2668-3-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/2668-2-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/2668-9-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download