cb0f95686faea0e5f4015113ee4a99c9c3f01ad85d15bf25d32c563d44fa26f8

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 01:25

Target

06d39630d57807f49e3387d9881ea302_JaffaCakes118.dll
Size

67KB
MD5

06d39630d57807f49e3387d9881ea302
SHA1

5f5a4c575f1728d57e2753a487210e14bc604477
SHA256

cb0f95686faea0e5f4015113ee4a99c9c3f01ad85d15bf25d32c563d44fa26f8
SHA512

f5b74af85cb3035f6139600d19a775d0c095e784b29696f218794f6200a892edbe7e7bf64b666c864f49b77a6a6311625f41b08cf7dbb9ea8629e8d6cdfa295b
SSDEEP

1536:4yBCh3zd7nCBjaL2SWlN/r1WmI/98K9bxW/h4tX1DwFjI:LWYBC6//r1p89B0h4tFDok

Score

7^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2624-0-0x0000000000180000-0x000000000018E000-memory.dmp	upx
behavioral1/memory/2624-4-0x0000000000180000-0x000000000018E000-memory.dmp	upx
behavioral1/memory/2624-3-0x0000000000180000-0x000000000018E000-memory.dmp	upx
behavioral1/memory/2624-7-0x0000000000180000-0x000000000018E000-memory.dmp	upx
behavioral1/memory/2624-6-0x0000000000180000-0x000000000018E000-memory.dmp	upx
behavioral1/memory/2624-8-0x0000000000180000-0x000000000018E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2624	2336	rundll32.exe	28
PID 2336 wrote to memory of 2624	2336	rundll32.exe	28
PID 2336 wrote to memory of 2624	2336	rundll32.exe	28
PID 2336 wrote to memory of 2624	2336	rundll32.exe	28
PID 2336 wrote to memory of 2624	2336	rundll32.exe	28
PID 2336 wrote to memory of 2624	2336	rundll32.exe	28
PID 2336 wrote to memory of 2624	2336	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06d39630d57807f49e3387d9881ea302_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06d39630d57807f49e3387d9881ea302_JaffaCakes118.dll,#1
  2⤵
  PID:2624

memory/2624-0-0x0000000000180000-0x000000000018E000-memory.dmp

Filesize
56KB

Download
memory/2624-4-0x0000000000180000-0x000000000018E000-memory.dmp

Filesize
56KB

Download
memory/2624-3-0x0000000000180000-0x000000000018E000-memory.dmp

Filesize
56KB

Download
memory/2624-7-0x0000000000180000-0x000000000018E000-memory.dmp

Filesize
56KB

Download
memory/2624-6-0x0000000000180000-0x000000000018E000-memory.dmp

Filesize
56KB

Download
memory/2624-5-0x0000000000170000-0x0000000000176000-memory.dmp

Filesize
24KB

Download
memory/2624-8-0x0000000000180000-0x000000000018E000-memory.dmp

Filesize
56KB

Download