f480f259e0233dd9d46a3300d65aac4566e076b94f2ca5392f99f2f8d7981092

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 05:11

Target

66445a7afa82653c9233d1fea0101d58_JaffaCakes118.exe
Size

8KB
MD5

66445a7afa82653c9233d1fea0101d58
SHA1

93c3187fbe9556b79ae63fd6bc8b3a16c3dfaefc
SHA256

f480f259e0233dd9d46a3300d65aac4566e076b94f2ca5392f99f2f8d7981092
SHA512

6e3213ebab992b2244b5d70503c3b117e111633586e506d5c2b5f235478e40bb4aec1708ce399a0509766d490fd181a4324a43ca71fa8581c8e24e779757dd6b
SSDEEP

192:zCnhky77yRHriBS5LPV4xaBf/1gTFr+7wEtZoVf0JprzBhzLSbBd:zEntVxe/10FrORroVf0Jx/LMj

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2816-0-0x0000000013140000-0x0000000013148000-memory.dmp	upx
behavioral1/memory/2816-1-0x0000000013140000-0x0000000013148000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2860	2816	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2860	2816	66445a7afa82653c9233d1fea0101d58_JaffaCakes118.exe	30
PID 2816 wrote to memory of 2860	2816	66445a7afa82653c9233d1fea0101d58_JaffaCakes118.exe	30
PID 2816 wrote to memory of 2860	2816	66445a7afa82653c9233d1fea0101d58_JaffaCakes118.exe	30
PID 2816 wrote to memory of 2860	2816	66445a7afa82653c9233d1fea0101d58_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\66445a7afa82653c9233d1fea0101d58_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\66445a7afa82653c9233d1fea0101d58_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 92
  2⤵
  - Program crash
  PID:2860

memory/2816-0-0x0000000013140000-0x0000000013148000-memory.dmp

Filesize
32KB

Download
memory/2816-1-0x0000000013140000-0x0000000013148000-memory.dmp

Filesize
32KB

Download