ba93eba5e6e01e4b2e18c0fbb5a6a40b54beb9a3015c7e730546112dbf1b2016

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 05:56

Target

24dbe95679c3d07a9640914e106d2252_JaffaCakes118.dll
Size

73KB
MD5

24dbe95679c3d07a9640914e106d2252
SHA1

c468c0be18855981ffd6f4a3c22cb965ad8c579b
SHA256

ba93eba5e6e01e4b2e18c0fbb5a6a40b54beb9a3015c7e730546112dbf1b2016
SHA512

04efc6a6758d5e261355a71757af42d78a0363e2aa74f4e9265a04ec49db5cf491eee2c431edd276c10121c5fc79cb4208a42b971e0f0b519091003a09ef6e93
SSDEEP

1536:5jRmOCW8lNJKj4y0p5RGamQQ3mHNzrR8OgkL65J31EtX:xf4s4y0pWaNQ3mHoF1Ed

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2364-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2364	1628	rundll32.exe	28
PID 1628 wrote to memory of 2364	1628	rundll32.exe	28
PID 1628 wrote to memory of 2364	1628	rundll32.exe	28
PID 1628 wrote to memory of 2364	1628	rundll32.exe	28
PID 1628 wrote to memory of 2364	1628	rundll32.exe	28
PID 1628 wrote to memory of 2364	1628	rundll32.exe	28
PID 1628 wrote to memory of 2364	1628	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24dbe95679c3d07a9640914e106d2252_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24dbe95679c3d07a9640914e106d2252_JaffaCakes118.dll,#1
  2⤵
  PID:2364

memory/2364-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download