434a4f687598897694f8d9bf7a714e87cf26f5c42824060442df102977661e6c

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 02:41

Target

245baada225fc281c0e29fbdd234390b_JaffaCakes118.dll
Size

68KB
MD5

245baada225fc281c0e29fbdd234390b
SHA1

5ed7ecb7307ceaddab05ca5325469f25926a591f
SHA256

434a4f687598897694f8d9bf7a714e87cf26f5c42824060442df102977661e6c
SHA512

669ae1b55004d34a35023e7aecad55f9762146b45df93e3a6ea6533d2fc056b68d4c11143ea857e331853e5b0736a6c14bcb657c192bc534becb2b4fa2d6d135
SSDEEP

1536:vxKNIuYi3uYFg6Dbn36o7sdoCTgzQsoygi1p9tQdZmFER:v6Yi3/5n3H7sdoCTg8soap9Sm+R

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2560-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2560	2924	rundll32.exe	28
PID 2924 wrote to memory of 2560	2924	rundll32.exe	28
PID 2924 wrote to memory of 2560	2924	rundll32.exe	28
PID 2924 wrote to memory of 2560	2924	rundll32.exe	28
PID 2924 wrote to memory of 2560	2924	rundll32.exe	28
PID 2924 wrote to memory of 2560	2924	rundll32.exe	28
PID 2924 wrote to memory of 2560	2924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\245baada225fc281c0e29fbdd234390b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\245baada225fc281c0e29fbdd234390b_JaffaCakes118.dll,#1
  2⤵
  PID:2560

memory/2560-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download