7171d4b5d2b836a4fd79a0bc148e5d8719cc39b40e17325a033ce538cdd913f2

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 08:03

Target

19620b295ee70d9e596095f014af0a48_JaffaCakes118.dll
Size

66KB
MD5

19620b295ee70d9e596095f014af0a48
SHA1

e2d20aaca33ee99cc1b2e6c20f011b91ea19f80a
SHA256

7171d4b5d2b836a4fd79a0bc148e5d8719cc39b40e17325a033ce538cdd913f2
SHA512

5b8e1b2422f1173d8fbee179aebb53471897b65183ba3e8bc45990d39effcda1174f40273842ce823826f9accd3dfbd3383112158dda0394be110ad1253357d8
SSDEEP

1536:n56EgIwI/DVyyd1YaEsJ+a5xLuF1vFf9sI8Qn:n56BtILV1d1usJ+a50Rj

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1392-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1392	1680	rundll32.exe	28
PID 1680 wrote to memory of 1392	1680	rundll32.exe	28
PID 1680 wrote to memory of 1392	1680	rundll32.exe	28
PID 1680 wrote to memory of 1392	1680	rundll32.exe	28
PID 1680 wrote to memory of 1392	1680	rundll32.exe	28
PID 1680 wrote to memory of 1392	1680	rundll32.exe	28
PID 1680 wrote to memory of 1392	1680	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\19620b295ee70d9e596095f014af0a48_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\19620b295ee70d9e596095f014af0a48_JaffaCakes118.dll,#1
  2⤵
  PID:1392

memory/1392-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download