6021a69792dbc8e62deb9fa99eecfd8ba29ac8b25f7a97ff8063b33d194e8592

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 14:14

Target

08fedeb21788d01ff308d25a44467cb1_JaffaCakes118.dll
Size

16KB
MD5

08fedeb21788d01ff308d25a44467cb1
SHA1

fce6a21bd990a42012e7ef20b44fac8813fb8906
SHA256

6021a69792dbc8e62deb9fa99eecfd8ba29ac8b25f7a97ff8063b33d194e8592
SHA512

55412b4ca2b49785f612f98f895ee2b5f7c504f59101bfa998b7a3c269cfa209d8326b081c7c766061dfc5051d7db59a17fd748679ac58f7a30bd6f0b3d7235d
SSDEEP

384:5mr0BG0eiyAikmg9bdWdBcKjizEQYyZRGvf/b+4PfFN9SaEcOjfX:Ir0Bfei3ygLKqfRGXjlP7MiOjf

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1636-1-0x0000000074EC0000-0x0000000074ECF000-memory.dmp	upx
behavioral1/memory/1636-0-0x0000000074EC0000-0x0000000074ECF000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1636	2208	rundll32.exe	28
PID 2208 wrote to memory of 1636	2208	rundll32.exe	28
PID 2208 wrote to memory of 1636	2208	rundll32.exe	28
PID 2208 wrote to memory of 1636	2208	rundll32.exe	28
PID 2208 wrote to memory of 1636	2208	rundll32.exe	28
PID 2208 wrote to memory of 1636	2208	rundll32.exe	28
PID 2208 wrote to memory of 1636	2208	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\08fedeb21788d01ff308d25a44467cb1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\08fedeb21788d01ff308d25a44467cb1_JaffaCakes118.dll,#1
  2⤵
  PID:1636

memory/1636-3-0x0000000074EC0000-0x0000000074ECF000-memory.dmp

Filesize
60KB

Download
memory/1636-7-0x0000000074EC1000-0x0000000074ECB000-memory.dmp

Filesize
40KB

Download
memory/1636-6-0x0000000074ECB000-0x0000000074ECC000-memory.dmp

Filesize
4KB

Download
memory/1636-5-0x0000000074EC0000-0x0000000074ECF000-memory.dmp

Filesize
60KB

Download
memory/1636-4-0x0000000074ED0000-0x0000000074EDF000-memory.dmp

Filesize
60KB

Download
memory/1636-2-0x0000000074ED0000-0x0000000074EDF000-memory.dmp

Filesize
60KB

Download
memory/1636-1-0x0000000074EC0000-0x0000000074ECF000-memory.dmp

Filesize
60KB

Download
memory/1636-0-0x0000000074EC0000-0x0000000074ECF000-memory.dmp

Filesize
60KB

Download