9e5da4b1f71dcb254a0264ad6c25286132ddac811edbc6be89dc86f9b6d871d4

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 17:26

Target

0eeba3acf3ab46190c84be4cb21652b7_JaffaCakes118.dll
Size

13KB
MD5

0eeba3acf3ab46190c84be4cb21652b7
SHA1

5eefb61bb10ccb44e9f9c6349565bdb70374be4c
SHA256

9e5da4b1f71dcb254a0264ad6c25286132ddac811edbc6be89dc86f9b6d871d4
SHA512

a9b05e2bb09a7d516a21df50a25bd6ee98fb255a77d855f92e7e606b82b6c99e5ccc6470b0739fa645d203926f24c260e136d8163ef502955714d543bc140e6b
SSDEEP

192:BwK/Fy3d518xMFKq13KxNEzAcNZqfMmAhlA3GYsWSC7iDs29mdaZtDr1h2LGr80t:Ba5qxhq13KxNu9X9dD3mdaZtDr1hmo6W

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1936-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
472	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1936	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1936	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 1936	2980	rundll32.exe	28
PID 2980 wrote to memory of 1936	2980	rundll32.exe	28
PID 2980 wrote to memory of 1936	2980	rundll32.exe	28
PID 2980 wrote to memory of 1936	2980	rundll32.exe	28
PID 2980 wrote to memory of 1936	2980	rundll32.exe	28
PID 2980 wrote to memory of 1936	2980	rundll32.exe	28
PID 2980 wrote to memory of 1936	2980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0eeba3acf3ab46190c84be4cb21652b7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0eeba3acf3ab46190c84be4cb21652b7_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1936

memory/1936-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download