2cac7d325af11bcb6d0a0d6dc3fdc31a48e0d7b46d1c9b6c44701dac0edf54c1

Analysis

max time kernel
150s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 12:20

Target

6335f496b459eb4860adb35b8a39eb1a_JaffaCakes118.exe
Size

187KB
MD5

6335f496b459eb4860adb35b8a39eb1a
SHA1

ed5d70d6e8073c826c2bd2ae53d2dddca48604fd
SHA256

2cac7d325af11bcb6d0a0d6dc3fdc31a48e0d7b46d1c9b6c44701dac0edf54c1
SHA512

80ba3ea583abfffb4714c423ea7795eca0c325a85d93cbee08db5ff9e78a91289f45cb3f37f71903d56aa20c7f649aba0db88b2d3890c69bce1fb2daa4db7a81
SSDEEP

3072:jyz1L02FCDTyOwJ+ReqajQwBKRS05fJdxR67at2kdEbOt0WIX1pQK0P:+9j8SOBSBBKY051R/tV+bOEg

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2488-0-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/2488-2-0x0000000000230000-0x000000000025A000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2488	6335f496b459eb4860adb35b8a39eb1a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 1956	2488	6335f496b459eb4860adb35b8a39eb1a_JaffaCakes118.exe	28
PID 2488 wrote to memory of 1956	2488	6335f496b459eb4860adb35b8a39eb1a_JaffaCakes118.exe	28
PID 2488 wrote to memory of 1956	2488	6335f496b459eb4860adb35b8a39eb1a_JaffaCakes118.exe	28
PID 2488 wrote to memory of 1956	2488	6335f496b459eb4860adb35b8a39eb1a_JaffaCakes118.exe	28
PID 2488 wrote to memory of 1956	2488	6335f496b459eb4860adb35b8a39eb1a_JaffaCakes118.exe	28
PID 2488 wrote to memory of 1956	2488	6335f496b459eb4860adb35b8a39eb1a_JaffaCakes118.exe	28
PID 2488 wrote to memory of 1956	2488	6335f496b459eb4860adb35b8a39eb1a_JaffaCakes118.exe	28

memory/1956-5-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/1956-4-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/1956-7-0x0000000000F52000-0x0000000000F53000-memory.dmp

Filesize
4KB

Download
memory/1956-8-0x0000000000F50000-0x0000000000F58000-memory.dmp

Filesize
32KB

Download
memory/2488-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2488-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2488-2-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/2488-6-0x0000000000290000-0x00000000002A4000-memory.dmp

Filesize
80KB

Download
memory/2488-3-0x0000000000290000-0x00000000002A4000-memory.dmp

Filesize
80KB

Download