3f2415360f17b1f32939ac672eab4c21d373d0152b60a3859b1eabcb8537a5b4

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 21:43

Target

f6a226e9135ecc19a1591c1b0685037b_JaffaCakes118.dll
Size

45KB
MD5

f6a226e9135ecc19a1591c1b0685037b
SHA1

21a84b185c11c21fd8e77f39b3366b34c79929f8
SHA256

3f2415360f17b1f32939ac672eab4c21d373d0152b60a3859b1eabcb8537a5b4
SHA512

59829be82294828fff9cdb1d39b14df2b2d8afc9bd9cc46c99673ed1b53219a84fe9a83253a7804fe8ca59048712a2824e656f3ede1a1667f82da28d75d98420
SSDEEP

768:GQxrhypDESkRA0HVCzXrx1KERxDwxWjldn6iRgvlNnOGhELR6BvK2K+jBuJnvM0V:GQ3tfgXKuxDwxMJx4LOF6VKD1vMRu5Eu

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1112-0-0x0000000010000000-0x0000000010016000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1112	2180	rundll32.exe	28
PID 2180 wrote to memory of 1112	2180	rundll32.exe	28
PID 2180 wrote to memory of 1112	2180	rundll32.exe	28
PID 2180 wrote to memory of 1112	2180	rundll32.exe	28
PID 2180 wrote to memory of 1112	2180	rundll32.exe	28
PID 2180 wrote to memory of 1112	2180	rundll32.exe	28
PID 2180 wrote to memory of 1112	2180	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6a226e9135ecc19a1591c1b0685037b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6a226e9135ecc19a1591c1b0685037b_JaffaCakes118.dll,#1
  2⤵
  PID:1112

memory/1112-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/1112-1-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/1112-2-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download