6bebd89e1baa4ba1b39e89e140f6cac87d942a6d3b01030527dbd31bcba11be2

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 17:32

Target

09de9b9cebac7fc1bf9ce6fcc719b959_JaffaCakes118.dll
Size

9KB
MD5

09de9b9cebac7fc1bf9ce6fcc719b959
SHA1

e9c263ffe09a5e6056ac576f7d41bda8da230df4
SHA256

6bebd89e1baa4ba1b39e89e140f6cac87d942a6d3b01030527dbd31bcba11be2
SHA512

2f5e8547d3ba3382e8475c90d0b409a35fcd9ca4fe4f2132c9e25f49db8de5ee3c427e6d147450c31f0f2a44153db76ffa9572ceee94cee282a64adf762d8c00
SSDEEP

192:bW33geD+8vKt7oMdP8qPu+TqcxHz1K3a5+mA:iweD+4KxHuCq6T1Kf

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1616-0-0x0000000025000000-0x0000000025011000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 18 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 1616	2052	rundll32.exe	28
PID 2052 wrote to memory of 1616	2052	rundll32.exe	28
PID 2052 wrote to memory of 1616	2052	rundll32.exe	28
PID 2052 wrote to memory of 1616	2052	rundll32.exe	28
PID 2052 wrote to memory of 1616	2052	rundll32.exe	28
PID 2052 wrote to memory of 1616	2052	rundll32.exe	28
PID 2052 wrote to memory of 1616	2052	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09de9b9cebac7fc1bf9ce6fcc719b959_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09de9b9cebac7fc1bf9ce6fcc719b959_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1616

memory/1616-0-0x0000000025000000-0x0000000025011000-memory.dmp

Filesize
68KB

Download