3dd61140e55e2d4fdc5918a1bdeec3c79486b85ecec5ca9800731227db481cbd

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 14:47

Target

f6047375a2309cc93aef6825c09e1543_JaffaCakes118.dll
Size

67KB
MD5

f6047375a2309cc93aef6825c09e1543
SHA1

25887e273b6a9962b5b5a805a75ec1ab11e149ed
SHA256

3dd61140e55e2d4fdc5918a1bdeec3c79486b85ecec5ca9800731227db481cbd
SHA512

716992a00371384077fac926ac065346490ca8843b705d5c5aea7bc2fc921b495de2a4df1d88982a35aa6c7b7f05542776ee301584bde0811c42d46947dcd5a8
SSDEEP

1536:93WY5azd03N2V+IWVLCCTZbgydBSo/srreae:0Y6GwYIWVgydBB0v6

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1652-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 1652	2120	rundll32.exe	28
PID 2120 wrote to memory of 1652	2120	rundll32.exe	28
PID 2120 wrote to memory of 1652	2120	rundll32.exe	28
PID 2120 wrote to memory of 1652	2120	rundll32.exe	28
PID 2120 wrote to memory of 1652	2120	rundll32.exe	28
PID 2120 wrote to memory of 1652	2120	rundll32.exe	28
PID 2120 wrote to memory of 1652	2120	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6047375a2309cc93aef6825c09e1543_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6047375a2309cc93aef6825c09e1543_JaffaCakes118.dll,#1
  2⤵
  PID:1652

memory/1652-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download