28f6c2bc3bf55eb9a683bb81258c3996043964a915c043e0fbd6318f9e5d07cd

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 22:32

Target

f6b745f4fc6bf809a52c7e2c43798f62_JaffaCakes118.dll
Size

43KB
MD5

f6b745f4fc6bf809a52c7e2c43798f62
SHA1

c878c19f9229c86161a2dc1c218205793e1315bf
SHA256

28f6c2bc3bf55eb9a683bb81258c3996043964a915c043e0fbd6318f9e5d07cd
SHA512

cea63f51c21855c8a0ae34df488c1131e8af0775622943e7c1847dd0467727f046518d8aee5f58faa744258c49735229828f0db8e17e729a1ed81d8d9f008b05
SSDEEP

768:NLq4/GmuTkzrda6+K0f+kXjb6hXsW4gPwe1JtM+8mzD+E0XrA4rmdU:5qUzHda3K8BXjbY3PwetULXrA4rm

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1216-0-0x0000000020000000-0x0000000020022000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1216	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1216	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1216	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1216	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1216	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1216	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1216	2200	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f6b745f4fc6bf809a52c7e2c43798f62_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f6b745f4fc6bf809a52c7e2c43798f62_JaffaCakes118.dll
  2⤵
  PID:1216

memory/1216-0-0x0000000020000000-0x0000000020022000-memory.dmp

Filesize
136KB

Download