5d4ade9c226dc3aeabf59581813e01884940af5c1463eb14c6fcc168aea14056

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 21:00

Target

e86830afbd823e15d1699558083ef39b_JaffaCakes118.dll
Size

98KB
MD5

e86830afbd823e15d1699558083ef39b
SHA1

4e60216eb2254ba660c47dcf386295d454ee1eda
SHA256

5d4ade9c226dc3aeabf59581813e01884940af5c1463eb14c6fcc168aea14056
SHA512

b0da0be40ea46ee0ef05d7948dd3ac109752d552e0632731f5dce28e718500db327b90049eba63ddf9b378247cbc2ca06b69e64b5a4938635099d88e997bf9dd
SSDEEP

1536:QPHd2owFn+G5mAGHnWaulatYjmuDyX6B95o4K0oOitxgLR18n2Gf0HAO5d2Apr:QP9hwdmPnWIWjm4yoLo//txgV182OOl

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1744-1-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 1744	2944	rundll32.exe	28
PID 2944 wrote to memory of 1744	2944	rundll32.exe	28
PID 2944 wrote to memory of 1744	2944	rundll32.exe	28
PID 2944 wrote to memory of 1744	2944	rundll32.exe	28
PID 2944 wrote to memory of 1744	2944	rundll32.exe	28
PID 2944 wrote to memory of 1744	2944	rundll32.exe	28
PID 2944 wrote to memory of 1744	2944	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e86830afbd823e15d1699558083ef39b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e86830afbd823e15d1699558083ef39b_JaffaCakes118.dll,#1
  2⤵
  PID:1744

memory/1744-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1744-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download