1778313d0929b1ddb515e1aef3c09d727fb221d6db021427d0d0c8afd460da0b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 13:43

Target

228e170e07cf252cae79443bd3a9ce6c_JaffaCakes118.dll
Size

48KB
MD5

228e170e07cf252cae79443bd3a9ce6c
SHA1

81434a3cd5db2563ce740f505d2967acbeaf1ae7
SHA256

1778313d0929b1ddb515e1aef3c09d727fb221d6db021427d0d0c8afd460da0b
SHA512

9962e7cddb9a031e627fe436171f9b1e239a95d239af8accf2a56581dea416e34a5bbb35de1af8e04de7a88561dd553f99a1be5fbc3f900c47a08815d3f3e73f
SSDEEP

1536:1zExMwCGQ2jukUE1mGJYnwKeo7HE4QZtd:1I+wCGvSsanC+E4OP

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1744-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 1744	2300	rundll32.exe	28
PID 2300 wrote to memory of 1744	2300	rundll32.exe	28
PID 2300 wrote to memory of 1744	2300	rundll32.exe	28
PID 2300 wrote to memory of 1744	2300	rundll32.exe	28
PID 2300 wrote to memory of 1744	2300	rundll32.exe	28
PID 2300 wrote to memory of 1744	2300	rundll32.exe	28
PID 2300 wrote to memory of 1744	2300	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\228e170e07cf252cae79443bd3a9ce6c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\228e170e07cf252cae79443bd3a9ce6c_JaffaCakes118.dll,#1
  2⤵
  PID:1744

memory/1744-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download