b46c44438c20a9dcddc824aefb1c2055ad0da616199f9797a4092271c04ff7e9

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 13:40

Target

6362f42be57915fa3e0e367120e31e76_JaffaCakes118.exe
Size

728KB
MD5

6362f42be57915fa3e0e367120e31e76
SHA1

70eca568ae3da60e8d53abdfa2ed6a442568448a
SHA256

b46c44438c20a9dcddc824aefb1c2055ad0da616199f9797a4092271c04ff7e9
SHA512

72f6dfda4f6e2768caa14f6cd30312a8b6873465e63925f0a71f435ebfa23e8c9938b8f8b449459b4f9cde05b542bb35786b99c7db6326bc39e42c874af0eaad
SSDEEP

12288:TLb58E2pBHGpQiKpBIuZNNiNsrXOL+ikJvRg597+QKUvrISU9Tv9:DeJpBniKpBPzQLkJ59aIfD

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2716-0-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral1/memory/2780-2-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral1/memory/2780-9-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral1/memory/2716-11-0x0000000000400000-0x00000000004EF000-memory.dmp	upx

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2780	2716	6362f42be57915fa3e0e367120e31e76_JaffaCakes118.exe	30
PID 2716 wrote to memory of 2780	2716	6362f42be57915fa3e0e367120e31e76_JaffaCakes118.exe	30
PID 2716 wrote to memory of 2780	2716	6362f42be57915fa3e0e367120e31e76_JaffaCakes118.exe	30
PID 2716 wrote to memory of 2780	2716	6362f42be57915fa3e0e367120e31e76_JaffaCakes118.exe	30
PID 2716 wrote to memory of 2780	2716	6362f42be57915fa3e0e367120e31e76_JaffaCakes118.exe	30
PID 2716 wrote to memory of 2780	2716	6362f42be57915fa3e0e367120e31e76_JaffaCakes118.exe	30
PID 2716 wrote to memory of 2780	2716	6362f42be57915fa3e0e367120e31e76_JaffaCakes118.exe	30
PID 2716 wrote to memory of 2780	2716	6362f42be57915fa3e0e367120e31e76_JaffaCakes118.exe	30
PID 2716 wrote to memory of 2780	2716	6362f42be57915fa3e0e367120e31e76_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\6362f42be57915fa3e0e367120e31e76_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6362f42be57915fa3e0e367120e31e76_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Users\Admin\AppData\Local\Temp\6362f42be57915fa3e0e367120e31e76_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\6362f42be57915fa3e0e367120e31e76_JaffaCakes118.exe"
  2⤵
  PID:2780

memory/2716-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2716-1-0x0000000000230000-0x000000000031F000-memory.dmp

Filesize
956KB

Download
memory/2716-11-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2780-2-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2780-3-0x0000000002520000-0x00000000025B4000-memory.dmp

Filesize
592KB

Download
memory/2780-8-0x0000000002520000-0x00000000025B4000-memory.dmp

Filesize
592KB

Download
memory/2780-9-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2780-10-0x0000000002520000-0x00000000025B4000-memory.dmp

Filesize
592KB

Download