6fac84d0504730e88a7db8d75911842e42d9be123a9abc33c28b57a7779e758d

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 01:16

Target

1841272a0b8ee066b3c30b8c935fe898_JaffaCakes118.dll
Size

53KB
MD5

1841272a0b8ee066b3c30b8c935fe898
SHA1

7ebdfd5e139859e486b7a0f280bd463dc4ba4b40
SHA256

6fac84d0504730e88a7db8d75911842e42d9be123a9abc33c28b57a7779e758d
SHA512

3a41da151ca060d44068c6308347a48d2d2ee19ab2f211eb1b1fcedd2a94a4cd0e3b77ac3b2139226eab92a1520132c31f8e4f2294b6f07f3bc16b23d8d5c2c7
SSDEEP

1536:eveObeNHniB7putIR7AozYNwXxytRQM5zK:XASHniB7Yt3NNwXxytRB5K

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2108-0-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 2108	308	rundll32.exe	28
PID 308 wrote to memory of 2108	308	rundll32.exe	28
PID 308 wrote to memory of 2108	308	rundll32.exe	28
PID 308 wrote to memory of 2108	308	rundll32.exe	28
PID 308 wrote to memory of 2108	308	rundll32.exe	28
PID 308 wrote to memory of 2108	308	rundll32.exe	28
PID 308 wrote to memory of 2108	308	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1841272a0b8ee066b3c30b8c935fe898_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1841272a0b8ee066b3c30b8c935fe898_JaffaCakes118.dll,#1
  2⤵
  PID:2108

memory/2108-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download