e348e0bc7ba98a052b61ac71280555f5a8f18d759ffc0ef8565611de34e41ebe

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 11:52

Target

ff37544a8279c9504fd0e8fa67aa029f_JaffaCakes118.dll
Size

71KB
MD5

ff37544a8279c9504fd0e8fa67aa029f
SHA1

5ccfc285262934bd809f12390d31e9a70cf0a4c7
SHA256

e348e0bc7ba98a052b61ac71280555f5a8f18d759ffc0ef8565611de34e41ebe
SHA512

e5c8facca26567ba5f027636c89d696a22603076d5a1dc4d7e159bf1b15936cacc485d13a6ca536269507efe005ddf60c8ef2055a3cfb749cc17e0765da6df7d
SSDEEP

1536:v6l4pvPztlHaDgiH4YrjoMWHf9SqIRIZ:yMPzt8DdYVMoVIIZ

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2472-0-0x0000000000190000-0x000000000019E000-memory.dmp	upx
behavioral1/memory/2472-3-0x0000000000190000-0x000000000019E000-memory.dmp	upx
behavioral1/memory/2472-4-0x0000000000190000-0x000000000019E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2472	1924	rundll32.exe	28
PID 1924 wrote to memory of 2472	1924	rundll32.exe	28
PID 1924 wrote to memory of 2472	1924	rundll32.exe	28
PID 1924 wrote to memory of 2472	1924	rundll32.exe	28
PID 1924 wrote to memory of 2472	1924	rundll32.exe	28
PID 1924 wrote to memory of 2472	1924	rundll32.exe	28
PID 1924 wrote to memory of 2472	1924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff37544a8279c9504fd0e8fa67aa029f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff37544a8279c9504fd0e8fa67aa029f_JaffaCakes118.dll,#1
  2⤵
  PID:2472

memory/2472-0-0x0000000000190000-0x000000000019E000-memory.dmp

Filesize
56KB

Download
memory/2472-3-0x0000000000190000-0x000000000019E000-memory.dmp

Filesize
56KB

Download
memory/2472-4-0x0000000000190000-0x000000000019E000-memory.dmp

Filesize
56KB

Download
memory/2472-5-0x0000000000170000-0x0000000000176000-memory.dmp

Filesize
24KB

Download
memory/2472-6-0x0000000000197000-0x000000000019D000-memory.dmp

Filesize
24KB

Download
memory/2472-7-0x0000000000191000-0x0000000000197000-memory.dmp

Filesize
24KB

Download