c1bc8c053f128ed058bf9623dbec472442835f22a9491d46cf6c1ad9f082be4f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 12:17

Target

fcc0efaf6f8294da3dae6391747fc6c5_JaffaCakes118.dll
Size

132KB
MD5

fcc0efaf6f8294da3dae6391747fc6c5
SHA1

d7e719a351065e3617731ac76d336038d529c167
SHA256

c1bc8c053f128ed058bf9623dbec472442835f22a9491d46cf6c1ad9f082be4f
SHA512

b611b8f7303961e900fcdc4b043e2e5d3472a9a3092fff2c5d58a1c3ab0821bc989f012a7a04c99a622af14a1f0a86c4b283cd835f0f7f7063d865bcf12b77a8
SSDEEP

3072:UJnaKvoc64P2l2P49cAwWsLAwluj7GVnvbdtpxNf:oJvo02l4AwfLAwdvbdtnl

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1736-0-0x0000000010000000-0x0000000010046000-memory.dmp	upx
behavioral1/memory/1736-4-0x0000000010000000-0x0000000010046000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\IME\	rundll32.exe
File opened for modification	C:\Windows\IME\68B08.tmp	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1736	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 1736	1772	rundll32.exe	28
PID 1772 wrote to memory of 1736	1772	rundll32.exe	28
PID 1772 wrote to memory of 1736	1772	rundll32.exe	28
PID 1772 wrote to memory of 1736	1772	rundll32.exe	28
PID 1772 wrote to memory of 1736	1772	rundll32.exe	28
PID 1772 wrote to memory of 1736	1772	rundll32.exe	28
PID 1772 wrote to memory of 1736	1772	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcc0efaf6f8294da3dae6391747fc6c5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcc0efaf6f8294da3dae6391747fc6c5_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:1736

memory/1736-0-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/1736-4-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download