a9bb6a9b18ab9aa449eca7ab0130c2d4ce4f56888d448e7262c2e0cef184df0e

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 15:20

Target

eb5f00986cc3107f07e23ffe014c9ff1_JaffaCakes118.dll
Size

56KB
MD5

eb5f00986cc3107f07e23ffe014c9ff1
SHA1

1ac8320f752704be3c8c70fadfd1e30bf80dcad8
SHA256

a9bb6a9b18ab9aa449eca7ab0130c2d4ce4f56888d448e7262c2e0cef184df0e
SHA512

d49886a2fa8518513b3bbddd0dcf5942546d287f2a2d00f03b1b56ecbdb6aa0ec859f046f985c27b3e494c4775b9960114e2d9134c93e2a0fb776131e526dc8c
SSDEEP

1536:G8LYtJPYfC+ZVouuTMxazglVOfAAhCqCU1iCf1fDYYzQ63lm5GecBO:G3PYqmfuTdzgz6pCdCtfDYkD305pcc

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2832-0-0x0000000010000000-0x000000001002E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2832	2660	regsvr32.exe	28
PID 2660 wrote to memory of 2832	2660	regsvr32.exe	28
PID 2660 wrote to memory of 2832	2660	regsvr32.exe	28
PID 2660 wrote to memory of 2832	2660	regsvr32.exe	28
PID 2660 wrote to memory of 2832	2660	regsvr32.exe	28
PID 2660 wrote to memory of 2832	2660	regsvr32.exe	28
PID 2660 wrote to memory of 2832	2660	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\eb5f00986cc3107f07e23ffe014c9ff1_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\eb5f00986cc3107f07e23ffe014c9ff1_JaffaCakes118.dll
  2⤵
  PID:2832

memory/2832-0-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download