c449a60084fb4a8a77706d6b79aa6d5752cc0b36381185dc2a6933992b6c98b7

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 03:34

Target

247d40cb67894041a5b4f21f6ee7a745_JaffaCakes118.dll
Size

55KB
MD5

247d40cb67894041a5b4f21f6ee7a745
SHA1

62e5df37aa38461ae2cad1af0f301718521c39b2
SHA256

c449a60084fb4a8a77706d6b79aa6d5752cc0b36381185dc2a6933992b6c98b7
SHA512

de8e66f48697b5380bd6118c5ca287390a3a5ee722f6fc0fb03bd023fb8c1b794b748ac70e6124a8dab80d6715b9f7b19a7c2eab2c43a97527c41a9287744df9
SSDEEP

768:Gx4m7JNSll3dTG+155lAFglgMeIMf1KZIfh6p0tFCQJkEgbMaywmj0UVQ0KO9EZ:Bm1NGJVGs5/zZelf1g0XBxg3IQATs

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2604-0-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2604	1368	rundll32.exe	28
PID 1368 wrote to memory of 2604	1368	rundll32.exe	28
PID 1368 wrote to memory of 2604	1368	rundll32.exe	28
PID 1368 wrote to memory of 2604	1368	rundll32.exe	28
PID 1368 wrote to memory of 2604	1368	rundll32.exe	28
PID 1368 wrote to memory of 2604	1368	rundll32.exe	28
PID 1368 wrote to memory of 2604	1368	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\247d40cb67894041a5b4f21f6ee7a745_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\247d40cb67894041a5b4f21f6ee7a745_JaffaCakes118.dll,#1
  2⤵
  PID:2604

memory/2604-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download