dde06fc66ce885d055ac37e4edfb02f12e8f24e46a38ba81b77c7efe6923714c

Analysis

max time kernel
139s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 03:36

Target

65fa12c545661df4afd20309bd35ade6_JaffaCakes118.exe
Size

372KB
MD5

65fa12c545661df4afd20309bd35ade6
SHA1

c965be63aca66a58d395902e6bc430b36f8b2a70
SHA256

dde06fc66ce885d055ac37e4edfb02f12e8f24e46a38ba81b77c7efe6923714c
SHA512

948feabb6a8af4e7c82608049716eab9d170818ccabef0ef6e6866ba64aa34bbf79de0901fea883a4a45562b72b1a22836b149bd7058ee021c9f0a497fcb31d0
SSDEEP

6144:8HIhipJQthiqpvFHWp27fcvgm5W6mBuirJ+c2zpEEA0+wjDFd:8HIhdhpAI6gP6HNzpENwfb

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2888-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/2888-3-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2888	65fa12c545661df4afd20309bd35ade6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 4624	2888	65fa12c545661df4afd20309bd35ade6_JaffaCakes118.exe	92
PID 2888 wrote to memory of 4624	2888	65fa12c545661df4afd20309bd35ade6_JaffaCakes118.exe	92
PID 2888 wrote to memory of 4624	2888	65fa12c545661df4afd20309bd35ade6_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\65fa12c545661df4afd20309bd35ade6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65fa12c545661df4afd20309bd35ade6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\65fa12c545661df4afd20309bd35ade6_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\65fa12c545661df4afd20309bd35ade6_JaffaCakes118.exe
  2⤵
  PID:4624

memory/2888-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2888-3-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download