185f76975fac7f26819373b707de7c5a8a772bb0245b14d81f2da7b16785e0d0

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 14:30

Target

06d66a3cf50f731ba74f1dd0151e5677_JaffaCakes118.dll
Size

36KB
MD5

06d66a3cf50f731ba74f1dd0151e5677
SHA1

22779aba9aed8f628a0dbfd178733bd29111ecc5
SHA256

185f76975fac7f26819373b707de7c5a8a772bb0245b14d81f2da7b16785e0d0
SHA512

f884d6e8c88fea3007f55ae492d6ba294e3f23055825728c2d7a760a820dc19fdc46941890eb246192470fc74e2fa632bc8b101b7d1bad7ea9279cf997b66a88
SSDEEP

768:XluSW1g5jyNG1fQng5eLhM+eRM7VdtZP3beMawPCD+EabAN1G3NhR4k:Xl4G5jxQng5shPeRM7/tFreNwPWv/Gdl

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2176-0-0x0000000010000000-0x000000001001C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2176	2220	rundll32.exe	28
PID 2220 wrote to memory of 2176	2220	rundll32.exe	28
PID 2220 wrote to memory of 2176	2220	rundll32.exe	28
PID 2220 wrote to memory of 2176	2220	rundll32.exe	28
PID 2220 wrote to memory of 2176	2220	rundll32.exe	28
PID 2220 wrote to memory of 2176	2220	rundll32.exe	28
PID 2220 wrote to memory of 2176	2220	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06d66a3cf50f731ba74f1dd0151e5677_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06d66a3cf50f731ba74f1dd0151e5677_JaffaCakes118.dll,#1
  2⤵
  PID:2176

memory/2176-0-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download