c56602f85db3bb70394935d4f405d409f766ebe3b4c39e497670b42639ecf554

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 00:45

Target

05dc4427882aef5cbd9530155fcaa988_JaffaCakes118.dll
Size

13KB
MD5

05dc4427882aef5cbd9530155fcaa988
SHA1

d0ea9ecddd4840b3ff563d9a07f46f97d5bbc235
SHA256

c56602f85db3bb70394935d4f405d409f766ebe3b4c39e497670b42639ecf554
SHA512

79cb42d2530fb4117e3b50531ef3d7cfa0c5459df85f7e5479eeb70863fd60451be6387fb3a3c2eb3b3abdb3551531c930294f31f265331e9d4ad70bc98f078e
SSDEEP

192:gvQqQLVXh8gaFLKlcMsDBe4dGTLlPG4pdAaTXdjjBxXp4eh6JhU89zvE4CP:gvaVmzFLNDDBe9TLlb7Xdjjrns+8tv0P

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1612-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1612-1-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 1612	1608	rundll32.exe	28
PID 1608 wrote to memory of 1612	1608	rundll32.exe	28
PID 1608 wrote to memory of 1612	1608	rundll32.exe	28
PID 1608 wrote to memory of 1612	1608	rundll32.exe	28
PID 1608 wrote to memory of 1612	1608	rundll32.exe	28
PID 1608 wrote to memory of 1612	1608	rundll32.exe	28
PID 1608 wrote to memory of 1612	1608	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05dc4427882aef5cbd9530155fcaa988_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05dc4427882aef5cbd9530155fcaa988_JaffaCakes118.dll,#1
  2⤵
  PID:1612

memory/1612-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1612-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download