0c20613d186817275c84d9c8f6bfa44f1a101390d4e9ad52d739eacfaa6762a1

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 14:38

Target

28835897dec27cfddc506e59f01d7f90_JaffaCakes118.dll
Size

47KB
MD5

28835897dec27cfddc506e59f01d7f90
SHA1

467e1e036a204e0770cf12dee30a846c05e91d3a
SHA256

0c20613d186817275c84d9c8f6bfa44f1a101390d4e9ad52d739eacfaa6762a1
SHA512

dd848aabc93d2334fc7c49be02908be3da0ba7564a78ee53314c6a5c7dff834f90d6084e59a9193b206b88e561982bc26e65c20b022ba3323b35eaad6170b0fe
SSDEEP

768:szM2xVV0yj9Bt7ceWdPnYBhMfkbnzGr+cv3hagYt4TjEdwbhrkKvOSDHPknGZ+:V2bCuPQvYBhMWnz+W/mI+pkKvOSDk++

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2696-0-0x0000000010000000-0x000000001000A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2696	2676	rundll32.exe	30
PID 2676 wrote to memory of 2696	2676	rundll32.exe	30
PID 2676 wrote to memory of 2696	2676	rundll32.exe	30
PID 2676 wrote to memory of 2696	2676	rundll32.exe	30
PID 2676 wrote to memory of 2696	2676	rundll32.exe	30
PID 2676 wrote to memory of 2696	2676	rundll32.exe	30
PID 2676 wrote to memory of 2696	2676	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28835897dec27cfddc506e59f01d7f90_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28835897dec27cfddc506e59f01d7f90_JaffaCakes118.dll,#1
  2⤵
  PID:2696

memory/2696-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download