1eef936bbc7095570278575cbc39d47e3b73ed93b49758c18da6cb8e9ecb4173

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 15:08

Target

fd09fc0c9eced14a46439ac52cb8748a_JaffaCakes118.dll
Size

66KB
MD5

fd09fc0c9eced14a46439ac52cb8748a
SHA1

9653dc9f1f6cc9e99d7eea4092a99266d469d4c1
SHA256

1eef936bbc7095570278575cbc39d47e3b73ed93b49758c18da6cb8e9ecb4173
SHA512

3dd05510af6384db709fe62190fbe30b03ec37685a6c456bd5356437315c71920052e4bdf526d89e560b58764bee871438353a81799023c2e45d9fec72b0c185
SSDEEP

1536:YRcCGPNvBMYOm1NHkDn8qJjfmMkX4NwlDiJO4N4JsI9FuZq3:NCGP3MYvCDn1Jju54SKNqFuZq3

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2344-0-0x0000000010000000-0x0000000010042000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2344	1612	rundll32.exe	28
PID 1612 wrote to memory of 2344	1612	rundll32.exe	28
PID 1612 wrote to memory of 2344	1612	rundll32.exe	28
PID 1612 wrote to memory of 2344	1612	rundll32.exe	28
PID 1612 wrote to memory of 2344	1612	rundll32.exe	28
PID 1612 wrote to memory of 2344	1612	rundll32.exe	28
PID 1612 wrote to memory of 2344	1612	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd09fc0c9eced14a46439ac52cb8748a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd09fc0c9eced14a46439ac52cb8748a_JaffaCakes118.dll,#1
  2⤵
  PID:2344

memory/2344-0-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download