7b9c9d02eb66321bf881375c089feb2d08917b024ccd02d34e5df2c41451d1d1

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 00:13

Target

fdfa190cde1ace94668fdad2381ff242_JaffaCakes118.dll
Size

95KB
MD5

fdfa190cde1ace94668fdad2381ff242
SHA1

4135f8ba230c85262f6e82bacc181f5728e50f09
SHA256

7b9c9d02eb66321bf881375c089feb2d08917b024ccd02d34e5df2c41451d1d1
SHA512

5d4b964648cec2285da7cbbbef981f5b9926dd2e0bd2c7d18b151af0ad434af41ce324d980c1fc909738c2c10070c1e12fd05ac225e0b05a814cb25dd60a6cf0
SSDEEP

1536:SQclh8MIwu5+oYqNENrm1x5BpCINR9qiaR8uIFQVK2:ahdIw/oYqNE1m1HBrNRAiaRR8QVZ

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2760-1-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2760	1760	rundll32.exe	28
PID 1760 wrote to memory of 2760	1760	rundll32.exe	28
PID 1760 wrote to memory of 2760	1760	rundll32.exe	28
PID 1760 wrote to memory of 2760	1760	rundll32.exe	28
PID 1760 wrote to memory of 2760	1760	rundll32.exe	28
PID 1760 wrote to memory of 2760	1760	rundll32.exe	28
PID 1760 wrote to memory of 2760	1760	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fdfa190cde1ace94668fdad2381ff242_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fdfa190cde1ace94668fdad2381ff242_JaffaCakes118.dll,#1
  2⤵
  PID:2760

memory/2760-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2760-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2760-2-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download