188c4ea4ce3f9748ce2d904112cf58121440313946054e4ba6428ef4fc34dbaf

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 18:35

Target

5d2b4cbfbdf71015d0844aab30b4e5e8_JaffaCakes118.exe
Size

928KB
MD5

5d2b4cbfbdf71015d0844aab30b4e5e8
SHA1

0eec4e6dcb25f3045e8f9127055d6955d1bc6b73
SHA256

188c4ea4ce3f9748ce2d904112cf58121440313946054e4ba6428ef4fc34dbaf
SHA512

1d1f073d0b778936073dc781d5f7911754ec9d0ced19694e734f8b23ee463fe92e153cea0399a1f89e73a81af889b2234fd4855c80bb3c9d657183835ef4b997
SSDEEP

24576:8IvOwSxZkHF7KLEPzkdB5qcSWXttueceBonDgt0jJOzkwF+/5:CsHF2LEPzkbttvBaDgejZwA5

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2672-3-0x0000000010000000-0x0000000010020000-memory.dmp	upx
behavioral1/memory/2672-2-0x0000000010000000-0x0000000010020000-memory.dmp	upx
behavioral1/memory/2672-0-0x0000000010000000-0x0000000010020000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2768	2672	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2768	2672	5d2b4cbfbdf71015d0844aab30b4e5e8_JaffaCakes118.exe	31
PID 2672 wrote to memory of 2768	2672	5d2b4cbfbdf71015d0844aab30b4e5e8_JaffaCakes118.exe	31
PID 2672 wrote to memory of 2768	2672	5d2b4cbfbdf71015d0844aab30b4e5e8_JaffaCakes118.exe	31
PID 2672 wrote to memory of 2768	2672	5d2b4cbfbdf71015d0844aab30b4e5e8_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\5d2b4cbfbdf71015d0844aab30b4e5e8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5d2b4cbfbdf71015d0844aab30b4e5e8_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 116
  2⤵
  - Program crash
  PID:2768

memory/2672-3-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2672-2-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2672-0-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download