6c3c8e8d5faf051ad435f7a31855add4e73c999fb357268a0e6731b135366cae

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 07:05

Target

0d246bf6d72d198851dcb6bb7ce7c306_JaffaCakes118.dll
Size

10KB
MD5

0d246bf6d72d198851dcb6bb7ce7c306
SHA1

a27659b04c0f168f973dd87fe1626afbc4b885a5
SHA256

6c3c8e8d5faf051ad435f7a31855add4e73c999fb357268a0e6731b135366cae
SHA512

dbc11f91899a7a095b523a56f40ed2e972e6e948fe9280b36121a7bb1b0422ec23289d94765c07d3cf551f06ab0fa33935f48c5893bea6977dfb46098a3d04c3
SSDEEP

192:UQRRREWyp+8Y2pkEXO9suOA6E97ZIWomoLaXPM8hIWiFW:n7+6196O9qAT945WKWiFW

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3024-0-0x0000000010000000-0x000000001000B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 3024	3008	rundll32.exe	28
PID 3008 wrote to memory of 3024	3008	rundll32.exe	28
PID 3008 wrote to memory of 3024	3008	rundll32.exe	28
PID 3008 wrote to memory of 3024	3008	rundll32.exe	28
PID 3008 wrote to memory of 3024	3008	rundll32.exe	28
PID 3008 wrote to memory of 3024	3008	rundll32.exe	28
PID 3008 wrote to memory of 3024	3008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d246bf6d72d198851dcb6bb7ce7c306_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d246bf6d72d198851dcb6bb7ce7c306_JaffaCakes118.dll,#1
  2⤵
  PID:3024

memory/3024-0-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download