4423f1800d84f522ce7f286a74655ced083aacdc887e2ce17152bd8b0340df02

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 10:23

Target

ed32980f109944f73f6f7fe180c449b6_JaffaCakes118.dll
Size

68KB
MD5

ed32980f109944f73f6f7fe180c449b6
SHA1

56cf44ddf86dc733480fcc3aadae656420ff7154
SHA256

4423f1800d84f522ce7f286a74655ced083aacdc887e2ce17152bd8b0340df02
SHA512

ef8837993ef02b29fd9b708627d07307c3e8cce627b6cd6f999029eb28f518496cc2b27e6606208ead62c93fc5468221966051065134999e5b1b38e8a57c2def
SSDEEP

1536:ev/5VYPO5kpVh/wdEjMc1nY/QcFv7/HYk:QThuVJvAc1Y4gv7d

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1760-0-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1760	1288	rundll32.exe	28
PID 1288 wrote to memory of 1760	1288	rundll32.exe	28
PID 1288 wrote to memory of 1760	1288	rundll32.exe	28
PID 1288 wrote to memory of 1760	1288	rundll32.exe	28
PID 1288 wrote to memory of 1760	1288	rundll32.exe	28
PID 1288 wrote to memory of 1760	1288	rundll32.exe	28
PID 1288 wrote to memory of 1760	1288	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed32980f109944f73f6f7fe180c449b6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed32980f109944f73f6f7fe180c449b6_JaffaCakes118.dll,#1
  2⤵
  PID:1760

memory/1760-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/1760-1-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download