737582712a064b095ba1a4891019d0ebdd4ffce5bbded9508ddcb757a6fc96c3

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 08:14

Target

eaa14454870ef9928066301dbc5950be_JaffaCakes118.dll
Size

58KB
MD5

eaa14454870ef9928066301dbc5950be
SHA1

7f8912f54a0aaf49d9e6479e1a5436e174caaa00
SHA256

737582712a064b095ba1a4891019d0ebdd4ffce5bbded9508ddcb757a6fc96c3
SHA512

73bdbeb5cb6f893fdecc0a160db1c9cf76a9199288e3c2968e52ef2418594fbbe43228a01c580aa93e914602ee67945af9616bc87c198cec657e2dd8221d211c
SSDEEP

768:op1VqVQwL6diO9DnPHjd4Xh9ajDtarcp5hWMM49mXMG5mkLc/wvRi0kJarfW0Xax:ob8Vwn/d4jaTHWqM3Lc4vNkCXuEkKa

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2364-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2364	2352	rundll32.exe	28
PID 2352 wrote to memory of 2364	2352	rundll32.exe	28
PID 2352 wrote to memory of 2364	2352	rundll32.exe	28
PID 2352 wrote to memory of 2364	2352	rundll32.exe	28
PID 2352 wrote to memory of 2364	2352	rundll32.exe	28
PID 2352 wrote to memory of 2364	2352	rundll32.exe	28
PID 2352 wrote to memory of 2364	2352	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eaa14454870ef9928066301dbc5950be_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eaa14454870ef9928066301dbc5950be_JaffaCakes118.dll,#1
  2⤵
  PID:2364

memory/2364-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download