5ff1312ff294988804eb0f6fd284e65ba7496a06cae5f9acd8b5096cfbe3683f

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 02:05

Target

01e8d7c61dc27d749ca99dd9a1ed6a9b_JaffaCakes118.dll
Size

71KB
MD5

01e8d7c61dc27d749ca99dd9a1ed6a9b
SHA1

3841dabc9d6985edef85465c7eaec73f4816fdab
SHA256

5ff1312ff294988804eb0f6fd284e65ba7496a06cae5f9acd8b5096cfbe3683f
SHA512

72e78c7b3ee8518542ceb496e141052ec633557063937e4ca08c4ab350c2d921b13d6c1aef47ceacd9db529ddd5da362910e5144a1e9f669e85a08c8ff356e6f
SSDEEP

1536:Z6yEOWXF+/A8kvOZf1EgV+ck8GoHSQ2wk5RngBRP0jnW9JlCK72YKHt:Qc37MOZfdVNk86Q2LTnsRsbYJEKaxHt

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1736-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1736	1504	rundll32.exe	28
PID 1504 wrote to memory of 1736	1504	rundll32.exe	28
PID 1504 wrote to memory of 1736	1504	rundll32.exe	28
PID 1504 wrote to memory of 1736	1504	rundll32.exe	28
PID 1504 wrote to memory of 1736	1504	rundll32.exe	28
PID 1504 wrote to memory of 1736	1504	rundll32.exe	28
PID 1504 wrote to memory of 1736	1504	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01e8d7c61dc27d749ca99dd9a1ed6a9b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01e8d7c61dc27d749ca99dd9a1ed6a9b_JaffaCakes118.dll,#1
  2⤵
  PID:1736

memory/1736-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download