44998c821435cb2b2dd13bba0c187b9894b8e3918b11a78e54588eb7675db628

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 12:29

Target

226527b266dd3752601c595b00f1cfd8_JaffaCakes118.dll
Size

14KB
MD5

226527b266dd3752601c595b00f1cfd8
SHA1

80f75279aefdf650d376d70733265d38c5d22166
SHA256

44998c821435cb2b2dd13bba0c187b9894b8e3918b11a78e54588eb7675db628
SHA512

89d3367955bb76d6073a1bebe79dbca21ca35a722e28c1b09bc98b8e22e71d670fc4877140e37f524cfc11258af004ecd1c7c1472b471acbc04e92c2d1ce10fe
SSDEEP

192:CedJRIXuTqBgMudoDtXqLt4Y+Qv8awshlTqA/o8AshYzHQlT7jPo7WiiG:Tdbgu4gbGXqLuY+Qv80XaQ7bo7N

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2248-0-0x0000000010000000-0x0000000010103000-memory.dmp	upx
behavioral1/memory/2248-1-0x0000000010000000-0x0000000010103000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2248	2072	rundll32.exe	28
PID 2072 wrote to memory of 2248	2072	rundll32.exe	28
PID 2072 wrote to memory of 2248	2072	rundll32.exe	28
PID 2072 wrote to memory of 2248	2072	rundll32.exe	28
PID 2072 wrote to memory of 2248	2072	rundll32.exe	28
PID 2072 wrote to memory of 2248	2072	rundll32.exe	28
PID 2072 wrote to memory of 2248	2072	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\226527b266dd3752601c595b00f1cfd8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\226527b266dd3752601c595b00f1cfd8_JaffaCakes118.dll,#1
  2⤵
  PID:2248

memory/2248-0-0x0000000010000000-0x0000000010103000-memory.dmp

Filesize
1.0MB

Download
memory/2248-1-0x0000000010000000-0x0000000010103000-memory.dmp

Filesize
1.0MB

Download
memory/2248-2-0x0000000010000000-0x0000000010103000-memory.dmp

Filesize
1.0MB

Download