701a7952d382c0774a510c934a4b590e5459d6e106e54556c34697685cc321ff

Analysis

max time kernel
118s
max time network
140s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 10:29

Target

fa1ab88d5447fb3c3711d65aba635a0b_JaffaCakes118.dll
Size

5KB
MD5

fa1ab88d5447fb3c3711d65aba635a0b
SHA1

3384d36d839a3fc35d1f4b18627a93cb22de9544
SHA256

701a7952d382c0774a510c934a4b590e5459d6e106e54556c34697685cc321ff
SHA512

eb0731585f399e54c55539a84a9c26b641d2396dc3b99884c027c4ae9941739b7aea36eb6e596c410249bff5dded9d5157e6b6e211a7ad87fdf6083815f9d963
SSDEEP

48:SYxs7l2mxeudMrwcnPZ7XTYvigbQqGGWONh2JpMmH7eRoafJ2JjFkl8jNzyf5lAY:Z+TdMtnh7cOuVh23703fJRMQDCev

Score

7^/10

upx

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/memory/2936-0-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect
behavioral1/memory/2936-1-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect
behavioral1/memory/2936-2-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2936-0-0x0000000010000000-0x000000001010B000-memory.dmp	upx
behavioral1/memory/2936-1-0x0000000010000000-0x000000001010B000-memory.dmp	upx
behavioral1/memory/2936-2-0x0000000010000000-0x000000001010B000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2936	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2936	2884	rundll32.exe	28
PID 2884 wrote to memory of 2936	2884	rundll32.exe	28
PID 2884 wrote to memory of 2936	2884	rundll32.exe	28
PID 2884 wrote to memory of 2936	2884	rundll32.exe	28
PID 2884 wrote to memory of 2936	2884	rundll32.exe	28
PID 2884 wrote to memory of 2936	2884	rundll32.exe	28
PID 2884 wrote to memory of 2936	2884	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa1ab88d5447fb3c3711d65aba635a0b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa1ab88d5447fb3c3711d65aba635a0b_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2936

memory/2936-0-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download
memory/2936-1-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download
memory/2936-2-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download