dd6e1da395dbdba8441c163321957b7a38ce5ae5d43333eebfb16818ebf35a87

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 16:17

Target

0988df4ec70bcb8ed36e967bb29464a4_JaffaCakes118.dll
Size

14KB
MD5

0988df4ec70bcb8ed36e967bb29464a4
SHA1

0acb139f0c2236f76568cc54f0542c8eb0ce1da9
SHA256

dd6e1da395dbdba8441c163321957b7a38ce5ae5d43333eebfb16818ebf35a87
SHA512

6b14b0a5871ba7a075c9d8cff765dc647dc0d0527ca580eacbb6c33fca374c68bc5e89696d90062c133f174b2ef7a0d55b8acc6d7fad172763686d6b4ef17dfb
SSDEEP

192:hXCGDdmj7ybUa2PS/Bl85JQo7OyB+ApStmtK2xBqbFJdexi58lyVt5IScfFzzX7/:hXCjj7yz2PCBl8T7amg6AgQ58l35X3+O

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1708-0-0x0000000010000000-0x0000000010010000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1708	2188	rundll32.exe	28
PID 2188 wrote to memory of 1708	2188	rundll32.exe	28
PID 2188 wrote to memory of 1708	2188	rundll32.exe	28
PID 2188 wrote to memory of 1708	2188	rundll32.exe	28
PID 2188 wrote to memory of 1708	2188	rundll32.exe	28
PID 2188 wrote to memory of 1708	2188	rundll32.exe	28
PID 2188 wrote to memory of 1708	2188	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0988df4ec70bcb8ed36e967bb29464a4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0988df4ec70bcb8ed36e967bb29464a4_JaffaCakes118.dll,#1
  2⤵
  PID:1708

memory/1708-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download