72ba051e41843be3b9565854d938d2ef9aa784b3b32dbbbceb636c38562a2f00

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 10:12

Target

e9c18497459ff65e267d64a176154cc8_JaffaCakes118.dll
Size

61KB
MD5

e9c18497459ff65e267d64a176154cc8
SHA1

653967ee92c546d95bb35f118c4070b8945ce6fb
SHA256

72ba051e41843be3b9565854d938d2ef9aa784b3b32dbbbceb636c38562a2f00
SHA512

62606a527803d78924f5ed6bd4c34198b05fb81af75c52a3fe05c1dced0b2437a584071d094d4effc0d337983faabf6e27d5394911b95b3b46497b6a83514e28
SSDEEP

1536:V2bs2YswRxGLpZMClcaDB7bB7pvRChVQj:WzJIG1ZMCl3V7bFpvRCO

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2880-0-0x0000000010000000-0x000000001000A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2880	2236	rundll32.exe	28
PID 2236 wrote to memory of 2880	2236	rundll32.exe	28
PID 2236 wrote to memory of 2880	2236	rundll32.exe	28
PID 2236 wrote to memory of 2880	2236	rundll32.exe	28
PID 2236 wrote to memory of 2880	2236	rundll32.exe	28
PID 2236 wrote to memory of 2880	2236	rundll32.exe	28
PID 2236 wrote to memory of 2880	2236	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9c18497459ff65e267d64a176154cc8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9c18497459ff65e267d64a176154cc8_JaffaCakes118.dll,#1
  2⤵
  PID:2880

memory/2880-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download