9dac349ce61ea1d192729fede2d8593ed0b912d925a1e98979fa834488cab82a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 02:55

Target

0c293afae2c109e7b11425c1280ca5b3_JaffaCakes118.dll
Size

44KB
MD5

0c293afae2c109e7b11425c1280ca5b3
SHA1

f9ab9831c600c6c452128b838747daf9c2101b5c
SHA256

9dac349ce61ea1d192729fede2d8593ed0b912d925a1e98979fa834488cab82a
SHA512

8c8cf569432fc474cb921290ec025665d0c3694f1426d1c2dfc0e922f103485415dd3f83baba99a31332cdf33ed2096449178579205c250b82b211b0cc7ed127
SSDEEP

768:op1VqVQwL6diO9DnPHjr4eqwIXjGTWOLo/qj/GIPiGkUEkI6pHe9HRSD0wvhgQc:ob8Vwn/r4eqwOGTWOcM/G7Xb6pHevOfG

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2228-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2228	1628	rundll32.exe	28
PID 1628 wrote to memory of 2228	1628	rundll32.exe	28
PID 1628 wrote to memory of 2228	1628	rundll32.exe	28
PID 1628 wrote to memory of 2228	1628	rundll32.exe	28
PID 1628 wrote to memory of 2228	1628	rundll32.exe	28
PID 1628 wrote to memory of 2228	1628	rundll32.exe	28
PID 1628 wrote to memory of 2228	1628	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c293afae2c109e7b11425c1280ca5b3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c293afae2c109e7b11425c1280ca5b3_JaffaCakes118.dll,#1
  2⤵
  PID:2228

memory/2228-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download