6dfaaaf9e07daa7133a230b97e48fa27ddd94982a1d54a69167f05ed68ca63a9

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 22:09

Target

17b5b1a3b8f28cf8777ed0d83622cf66_JaffaCakes118.dll
Size

256KB
MD5

17b5b1a3b8f28cf8777ed0d83622cf66
SHA1

558f92638e11eb9f29ff4f697e7e1bf27d727c74
SHA256

6dfaaaf9e07daa7133a230b97e48fa27ddd94982a1d54a69167f05ed68ca63a9
SHA512

51c690f6e7bbc4988657cd1b2448231342c64b6d1ffda14d7f966454be42c16aa1060fa8e28f8f174793401b38193495b46df7476dfa35d3cd5a56be563e549b
SSDEEP

6144:pATSOjUQK8mbA9lab8as0So6gAA3gOg6POtYN:+SOxNjIb8auhrk24

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
1984	rundll32mgr.exe

Loads dropped DLL 2 IoCs

pid	Process
1056	rundll32.exe
1056	rundll32.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1056-3-0x0000000000140000-0x000000000019A000-memory.dmp	upx
behavioral1/files/0x000d000000012261-2.dat	upx
behavioral1/memory/1984-12-0x0000000000400000-0x000000000045A000-memory.dmp	upx
behavioral1/memory/1984-11-0x0000000000400000-0x000000000045A000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1056	1476	rundll32.exe	28
PID 1476 wrote to memory of 1056	1476	rundll32.exe	28
PID 1476 wrote to memory of 1056	1476	rundll32.exe	28
PID 1476 wrote to memory of 1056	1476	rundll32.exe	28
PID 1476 wrote to memory of 1056	1476	rundll32.exe	28
PID 1476 wrote to memory of 1056	1476	rundll32.exe	28
PID 1476 wrote to memory of 1056	1476	rundll32.exe	28
PID 1056 wrote to memory of 1984	1056	rundll32.exe	29
PID 1056 wrote to memory of 1984	1056	rundll32.exe	29
PID 1056 wrote to memory of 1984	1056	rundll32.exe	29
PID 1056 wrote to memory of 1984	1056	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17b5b1a3b8f28cf8777ed0d83622cf66_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\17b5b1a3b8f28cf8777ed0d83622cf66_JaffaCakes118.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    PID:1984

\Windows\SysWOW64\rundll32mgr.exe

Filesize
105KB

MD5
93e4449dccbca737dc4f039ea053fa66

SHA1
8007d95f904b6872971ea5a9b9ad878281e50a88

SHA256
d548fefa0b087af4a447f0eebf8af488a8943d1c0fc25cb11cdd9a0d0344ca62

SHA512
e3360327b9c99415c7f49a1f3f118af89545f918e83c27145b389a22f99707dee7cc026b9177534caace586f5a8994cdb6ae87d87b0b0294e7bc9183413cc11d

Download Submit
memory/1056-1-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download
memory/1056-3-0x0000000000140000-0x000000000019A000-memory.dmp

Filesize
360KB

Download
memory/1056-10-0x0000000000140000-0x000000000019A000-memory.dmp

Filesize
360KB

Download
memory/1984-13-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1984-12-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1984-11-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download