a8fe9d8109f0da2736e3c7a6fb5e98b29f834725a52da301d0cac2dc841542e3

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 13:24

Target

e78e8879aa3602eb81bdc473a14e6d29_JaffaCakes118.dll
Size

11KB
MD5

e78e8879aa3602eb81bdc473a14e6d29
SHA1

8f9788c6169fe8940423f2a3807ed90f9138d538
SHA256

a8fe9d8109f0da2736e3c7a6fb5e98b29f834725a52da301d0cac2dc841542e3
SHA512

ae0f665b526adab1619f22ac245b827c0358ec6cf5c8d946f39034af6baf51edfc3ebd0d9dcc0c2c7de0d04915a23044b0e3d99851e6e2451ec2d0f883d611b7
SSDEEP

192:nr4h1oj/ed/ma5dFpbXRO71NXXn+Y+uZSFlFnQ3pLy4RL2c1sdqixmOMfczAL:UjorUm8iNHn+80Uy4N2z1AY

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2176-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2176	2164	rundll32.exe	28
PID 2164 wrote to memory of 2176	2164	rundll32.exe	28
PID 2164 wrote to memory of 2176	2164	rundll32.exe	28
PID 2164 wrote to memory of 2176	2164	rundll32.exe	28
PID 2164 wrote to memory of 2176	2164	rundll32.exe	28
PID 2164 wrote to memory of 2176	2164	rundll32.exe	28
PID 2164 wrote to memory of 2176	2164	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e78e8879aa3602eb81bdc473a14e6d29_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e78e8879aa3602eb81bdc473a14e6d29_JaffaCakes118.dll,#1
  2⤵
  PID:2176

memory/2176-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download