432ea275e3524316b8b6cb19959b08bcda4fb6932052b976ba072d18f50048a4

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 21:22

Target
64dadcb1b70b27eb630686898bd05da4_JaffaCakes118.exe
Size 1.1MB
Sample240722-z717psyfka
SHA256 432ea275e3524316b8b6cb19959b08bcda4fb6932052b976ba072d18f50048a4
MD5 64dadcb1b70b27eb630686898bd05da4
SHA1 a1efde05f557c7a3ef40af5503068bdca77c21b5
SHA512 cd721a4175fe86a9392689b5e9daefacc5664fff9d0e1baf869965a4649df50134dcab159a2dc9d12188bb0b1e566ec5af581f4847046cf7c76da7c6b686b231
SSDEEP 24576:w5oJWJC8/Msb4o69Cfp2I4fkLD1/h5KqTWKBOdKieQKMMMMVxOk8j:w0WJ5p6pI4eD1/h5Kq6KwdKhQKMMMMVG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1972	64dadcb1b70b27eb630686898bd05da4_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1972-0-0x0000000000400000-0x000000000085F000-memory.dmp	upx
behavioral2/memory/1972-22-0x0000000000400000-0x000000000085F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 4596	1972	64dadcb1b70b27eb630686898bd05da4_JaffaCakes118.exe	85
PID 1972 wrote to memory of 4596	1972	64dadcb1b70b27eb630686898bd05da4_JaffaCakes118.exe	85
PID 1972 wrote to memory of 4596	1972	64dadcb1b70b27eb630686898bd05da4_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\64dadcb1b70b27eb630686898bd05da4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\64dadcb1b70b27eb630686898bd05da4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9F4D.tmp\[].BAT""
  2⤵
  PID:4596

[].BAT

Path C:\Users\Admin\AppData\Local\Temp\9F4D.tmp\[].BAT
Size 938B
SHA256 2e7b3b7abf42d450e4457da89f50713ddee10679ee4997d61e6f73029b6505c4
MD5 ffdc4fc2bdd0e9791fafc3079137be57
SHA1 ffa0dd5c7da775a5f948dd951cc01bdc5e07dde5
SHA512 8de47ec3c12b9ed7c6872fe436fe1037f298b2dfcd5e95f84f8c4526fc763ba5277bc7cb0690f4ccdcf898239118967cad152d848f8a5f084ba8e152059bd59b
MD5 SHA1 SHA512

Submit Download

b2e.dll

Path C:\Users\Admin\AppData\Local\Temp\9F4D.tmp\b2e.dll
Size 31KB
SHA256 57a2586d73188a694944c7da60c78380f82fac46452ed1a31c818ceb93e660bc
MD5 7b860f28be19d4aef761fb991134a556
SHA1 0658a7456d0234dcca598b6ee599fe134d0ecd61
SHA512 a0685a25cbc3fff74aa4ad538ade5282242980f07fe1171e01644e0fa98e1ec6adc87b943290983f6fb5070d26fc15d697ae31a1f570e83e504ae1e4508aefa5
SSDEEP 384:j7n/dxOnBXPDVsjmB+M0aOIVDwHQRrNRZqrVMUSNNZ8Kiw:n/d8BbVsjmLl0HGRKVyqKiw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1972-0-0x0000000000400000-0x000000000085F000-memory.dmp

Download

memory/1972-22-0x0000000000400000-0x000000000085F000-memory.dmp

Download