85f01befec9502cbb724fd9aa716733b4e4baa367726053f21110b75ede907f1

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 01:09

Target

622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe
Size

20KB
MD5

622f065c4806d558a1875c45d3a684d5
SHA1

3e2892607e5de061689d267aeaf4960233b16c65
SHA256

85f01befec9502cbb724fd9aa716733b4e4baa367726053f21110b75ede907f1
SHA512

7c9e9c14d0ffa12c1a775374b0ea9a46326d136ca61e7a7f11de823bd5e32cbb54c414593dc0e2c1d14af66f782c3b34d6f32c271748570b567ea9cade03cbad
SSDEEP

384:oVe5cW7BHazacScE2x5Fx/r+TAYj8PxEdOeeXozHJsyktJKj37VRTvZ6XwPLAvMh:og5cW8acSIP+TAYjkSekpGzKn/rZi4Uu

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2736-0-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/2736-9-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2796	2736	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	30
PID 2736 wrote to memory of 2796	2736	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	30
PID 2736 wrote to memory of 2796	2736	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	30
PID 2736 wrote to memory of 2796	2736	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	30
PID 2736 wrote to memory of 2796	2736	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	30
PID 2736 wrote to memory of 2796	2736	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	30
PID 2736 wrote to memory of 2796	2736	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	30
PID 2736 wrote to memory of 2796	2736	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	30
PID 2736 wrote to memory of 2796	2736	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	30
PID 2736 wrote to memory of 2796	2736	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	30
PID 2736 wrote to memory of 2796	2736	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	30
PID 2736 wrote to memory of 2796	2736	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	30
PID 2736 wrote to memory of 2796	2736	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	30
PID 2736 wrote to memory of 2796	2736	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\fixmapi.exe
  "C:\Windows\system32\12345\..\fixmapi.exe"
  2⤵
  PID:2796

memory/2736-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2736-9-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2796-7-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2796-6-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2796-5-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2796-4-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2796-3-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2796-1-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/2796-10-0x00000000000A0000-0x00000000000A8000-memory.dmp

Filesize
32KB

Download