997cc17bc3a19d92472ae8d23cb9070bdd2aa2841e1304c386e9014ead16bffc

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 14:54

Target

092cdd6113565b88c807abbaf3974087_JaffaCakes118.dll
Size

92KB
MD5

092cdd6113565b88c807abbaf3974087
SHA1

ec7af67bf088ad40307c5ebbcd6ef9a7653f2fc1
SHA256

997cc17bc3a19d92472ae8d23cb9070bdd2aa2841e1304c386e9014ead16bffc
SHA512

fffd45988706d9de00a114c6d668fcfd6ff66138d788520519bfd0d96dc4c417764c9270e1c4fa622a1d9b3bfb9ca15d1640d704e4563893e7b55a57e5d2e018
SSDEEP

1536:/xLK2OReR3CHmIxEDtQKezglyj654pyp0SAuIQK+/op:ZVOReRyHXmD2KezHj6WpDEbop

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1120-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 1120	2156	rundll32.exe	28
PID 2156 wrote to memory of 1120	2156	rundll32.exe	28
PID 2156 wrote to memory of 1120	2156	rundll32.exe	28
PID 2156 wrote to memory of 1120	2156	rundll32.exe	28
PID 2156 wrote to memory of 1120	2156	rundll32.exe	28
PID 2156 wrote to memory of 1120	2156	rundll32.exe	28
PID 2156 wrote to memory of 1120	2156	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\092cdd6113565b88c807abbaf3974087_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\092cdd6113565b88c807abbaf3974087_JaffaCakes118.dll,#1
  2⤵
  PID:1120

memory/1120-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download