2b1a6aba903b1bd27b88a2ec8d69c45ac106da7fa74d2ffe6739d9d10db5c003

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 08:01

Target

0d4d5ac118b07c96b349f5a2f543d5da_JaffaCakes118.dll
Size

99KB
MD5

0d4d5ac118b07c96b349f5a2f543d5da
SHA1

168d0d4ac492126cd0c2a2ccf1f74734a57538dd
SHA256

2b1a6aba903b1bd27b88a2ec8d69c45ac106da7fa74d2ffe6739d9d10db5c003
SHA512

2d298ac958a8b4c6b14d5b30f110c63018eefdde182d12a278aa0fba1a486b43c59146c737ebc35162b2e8ccdc9a9680603e780f3c65e246b1e7fa88f780925e
SSDEEP

1536:/xLK2OReR3CHRJseT7VzfHSMFMGgHjNBKEfg9Eyj1E+HbFbECqm:ZVOReRyHRGef9HSl9DNBK7Zj1DbFYrm

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2052-1-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral1/memory/2052-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d4d5ac118b07c96b349f5a2f543d5da_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d4d5ac118b07c96b349f5a2f543d5da_JaffaCakes118.dll,#1
  2⤵
  PID:2052

memory/2052-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2052-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download