97084184629a3182728ac0f3706bec384cb53d3fbbf1e3a61801f9caa0e762bd

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 09:19

Target

1abe1aff0a4168e581940e6f6ae793fc_JaffaCakes118.dll
Size

62KB
MD5

1abe1aff0a4168e581940e6f6ae793fc
SHA1

13902a7709986fd0b4075f9bda475fddc817d5ed
SHA256

97084184629a3182728ac0f3706bec384cb53d3fbbf1e3a61801f9caa0e762bd
SHA512

31bed8d0c1b39c357cef1f892d571f3ec2fb7ca44681a1b027b3d0636c4dd9c6c778862357bde3397b059892efd159fcf49ab779ca1bf1aec1e47e5b9c06ef98
SSDEEP

1536:23umoMtxLXBGptaHm89lBgrWlb9xShwV9O:CoMtxjBHmclGrGb9xShn

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2128-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2128	2392	rundll32.exe	28
PID 2392 wrote to memory of 2128	2392	rundll32.exe	28
PID 2392 wrote to memory of 2128	2392	rundll32.exe	28
PID 2392 wrote to memory of 2128	2392	rundll32.exe	28
PID 2392 wrote to memory of 2128	2392	rundll32.exe	28
PID 2392 wrote to memory of 2128	2392	rundll32.exe	28
PID 2392 wrote to memory of 2128	2392	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1abe1aff0a4168e581940e6f6ae793fc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1abe1aff0a4168e581940e6f6ae793fc_JaffaCakes118.dll,#1
  2⤵
  PID:2128

memory/2128-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2128-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download