85f01befec9502cbb724fd9aa716733b4e4baa367726053f21110b75ede907f1

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 01:09

Target

622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe
Size

20KB
MD5

622f065c4806d558a1875c45d3a684d5
SHA1

3e2892607e5de061689d267aeaf4960233b16c65
SHA256

85f01befec9502cbb724fd9aa716733b4e4baa367726053f21110b75ede907f1
SHA512

7c9e9c14d0ffa12c1a775374b0ea9a46326d136ca61e7a7f11de823bd5e32cbb54c414593dc0e2c1d14af66f782c3b34d6f32c271748570b567ea9cade03cbad
SSDEEP

384:oVe5cW7BHazacScE2x5Fx/r+TAYj8PxEdOeeXozHJsyktJKj37VRTvZ6XwPLAvMh:og5cW8acSIP+TAYjkSekpGzKn/rZi4Uu

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3660-0-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/3660-2-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 1272	3660	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	84
PID 3660 wrote to memory of 1272	3660	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	84
PID 3660 wrote to memory of 1272	3660	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	84
PID 3660 wrote to memory of 1272	3660	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	84
PID 3660 wrote to memory of 1272	3660	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	84
PID 3660 wrote to memory of 1272	3660	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	84
PID 3660 wrote to memory of 1272	3660	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	84
PID 3660 wrote to memory of 1272	3660	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	84
PID 3660 wrote to memory of 1272	3660	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	84
PID 3660 wrote to memory of 1272	3660	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	84
PID 3660 wrote to memory of 1272	3660	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	84
PID 3660 wrote to memory of 1272	3660	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	84
PID 3660 wrote to memory of 1272	3660	622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\622f065c4806d558a1875c45d3a684d5_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\SysWOW64\fixmapi.exe
  "C:\Windows\system32\12345\..\fixmapi.exe"
  2⤵
  PID:1272

memory/1272-3-0x0000000000DA0000-0x0000000000DA8000-memory.dmp

Filesize
32KB

Download
memory/3660-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3660-2-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download