a07a6c46c68c319cbcd43b6e8e06ce2e9c62e31817cfdf4174896c230aaf4fe6

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 08:15

Target

627558a21318d608f87b3402921628ee_JaffaCakes118.exe
Size

1.2MB
MD5

627558a21318d608f87b3402921628ee
SHA1

adab5dff893d3df5477145098ec10ed69f5b0f8a
SHA256

a07a6c46c68c319cbcd43b6e8e06ce2e9c62e31817cfdf4174896c230aaf4fe6
SHA512

d90c41ad1c88d368808599d92491b8aa3ed671e55fa8d7f95a6d0f06eda8e9f63b45336135104d6281f838247cfc56805ee7e27b144513f163c0f792b474428f
SSDEEP

24576:VhgdYZYSsWuxW+5YfA+mmSkAXyEW6bDI2Wtsrhi7v0aJJXcpAtyoH6eKC743:VhEZEdSRRbsEMQanspK/Pe

Score

7^/10

themida

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral1/memory/3040-8-0x0000000000400000-0x0000000000662000-memory.dmp	themida

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 1404	3040	627558a21318d608f87b3402921628ee_JaffaCakes118.exe	21
PID 3040 wrote to memory of 1404	3040	627558a21318d608f87b3402921628ee_JaffaCakes118.exe	21
PID 3040 wrote to memory of 1404	3040	627558a21318d608f87b3402921628ee_JaffaCakes118.exe	21
PID 3040 wrote to memory of 1404	3040	627558a21318d608f87b3402921628ee_JaffaCakes118.exe	21
PID 3040 wrote to memory of 1404	3040	627558a21318d608f87b3402921628ee_JaffaCakes118.exe	21
PID 3040 wrote to memory of 1404	3040	627558a21318d608f87b3402921628ee_JaffaCakes118.exe	21

memory/1404-5-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/1404-12-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/3040-1-0x0000000000310000-0x00000000003FA000-memory.dmp

Filesize
936KB

Download
memory/3040-0-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/3040-4-0x0000000000401000-0x0000000000408000-memory.dmp

Filesize
28KB

Download
memory/3040-3-0x0000000004270000-0x0000000004272000-memory.dmp

Filesize
8KB

Download
memory/3040-8-0x0000000000400000-0x0000000000662000-memory.dmp

Filesize
2.4MB

Download