1932d4995ed7f19b370f496654db40b8693ff4938c3791079b0c9b12f4bc50de

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 11:15

Target

1b15689e2eece0061526e849ba92949b_JaffaCakes118.dll
Size

87KB
MD5

1b15689e2eece0061526e849ba92949b
SHA1

9b651c9ebb9b9b0a0be367da5f737d94f1629f93
SHA256

1932d4995ed7f19b370f496654db40b8693ff4938c3791079b0c9b12f4bc50de
SHA512

685d3295a622351a7c150a0ceaeb0dcc25bcf9c994fdd4345464bbb3bd07596065d6e97e30be2ace659be8eecccf78b9ea0e477221c426a279eec2bdf0c84c48
SSDEEP

1536:Xrj2DTisS3kalQkAygY4JoWcTBMhiAeV8xqM7dibu1X:v2DTv1alQkaYqyTBQ9e6xd7

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1120-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1120	2248	rundll32.exe	28
PID 2248 wrote to memory of 1120	2248	rundll32.exe	28
PID 2248 wrote to memory of 1120	2248	rundll32.exe	28
PID 2248 wrote to memory of 1120	2248	rundll32.exe	28
PID 2248 wrote to memory of 1120	2248	rundll32.exe	28
PID 2248 wrote to memory of 1120	2248	rundll32.exe	28
PID 2248 wrote to memory of 1120	2248	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b15689e2eece0061526e849ba92949b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b15689e2eece0061526e849ba92949b_JaffaCakes118.dll,#1
  2⤵
  PID:1120

memory/1120-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download