866383ee4210ec0fc06dc23ad50f3d1b3ca3d6de5a73fe3879b7b8a1c9ee9585

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 07:26

Target

26c2b98c0ab0205b1c92b886f8942055_JaffaCakes118.exe
Size

141KB
MD5

26c2b98c0ab0205b1c92b886f8942055
SHA1

fe7136b5092bc13437fcbf368c4676deba4154d5
SHA256

866383ee4210ec0fc06dc23ad50f3d1b3ca3d6de5a73fe3879b7b8a1c9ee9585
SHA512

3839a127d846cb7c94759ecacef7c9ba2a3be2ddabec6865704ba59ca7518446a25810b315e1351503d922c8fedcc143007913c7f6184de5141ae329f6915dd0
SSDEEP

3072:Ds5Yvh1N6NlXudkIWgntto1PElQslrVdet57MQQKaw1Czue6piWqBRFkYak:DeY/Nm96toelQwrCtDQKaWCCyW2kg

Score

7^/10

UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

behavioral1/memory/1740-0-0x0000000001000000-0x0000000001052000-memory.dmp upx
behavioral1/memory/1740-1-0x0000000001000000-0x0000000001052000-memory.dmp upx
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2912 1740 WerFault.exe 26c2b98c0ab0205b1c92b886f8942055_JaffaCakes118.exe

resource	yara_rule
behavioral1/memory/1740-0-0x0000000001000000-0x0000000001052000-memory.dmp	upx
behavioral1/memory/1740-1-0x0000000001000000-0x0000000001052000-memory.dmp	upx

pid	pid_target	process	target process
2912	1740	WerFault.exe	26c2b98c0ab0205b1c92b886f8942055_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

26c2b98c0ab0205b1c92b886f8942055_JaffaCakes118.exe

description	pid	process	target process
PID 1740 wrote to memory of 2912	1740	26c2b98c0ab0205b1c92b886f8942055_JaffaCakes118.exe	WerFault.exe
PID 1740 wrote to memory of 2912	1740	26c2b98c0ab0205b1c92b886f8942055_JaffaCakes118.exe	WerFault.exe
PID 1740 wrote to memory of 2912	1740	26c2b98c0ab0205b1c92b886f8942055_JaffaCakes118.exe	WerFault.exe
PID 1740 wrote to memory of 2912	1740	26c2b98c0ab0205b1c92b886f8942055_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\26c2b98c0ab0205b1c92b886f8942055_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26c2b98c0ab0205b1c92b886f8942055_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 48
2⤵
- Program crash
PID:2912

memory/1740-0-0x0000000001000000-0x0000000001052000-memory.dmp

Filesize
328KB

Download
memory/1740-1-0x0000000001000000-0x0000000001052000-memory.dmp

Filesize
328KB

Download