6e3d3a14978cf463f86b61b9ef9775a85e7f05788875ac8f0d340456c22ab248

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 22:32

Target

2e0ff6eb919c6c03b938275834c2c224_JaffaCakes118.dll
Size

19KB
MD5

2e0ff6eb919c6c03b938275834c2c224
SHA1

baee8f3a4433b54fc4c5d583ea74edac8ff76fd9
SHA256

6e3d3a14978cf463f86b61b9ef9775a85e7f05788875ac8f0d340456c22ab248
SHA512

cc531271c626ab5b2b00e4392fdff08da5d3a401d6ce98c3c1f4960ed34649168a26972fd3a214ae4d61e09622aa17fd94aa4b51101aad040c81b063adec9713
SSDEEP

384:n5WfBssBK1QBiNCTDJJuS8fYH/Q3XLLFUur9AOs/9:5WfBPIQAMnJJ/8fS/kfFfpu9

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2860-2-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2860-1-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 11 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2860	2516	rundll32.exe	30
PID 2516 wrote to memory of 2860	2516	rundll32.exe	30
PID 2516 wrote to memory of 2860	2516	rundll32.exe	30
PID 2516 wrote to memory of 2860	2516	rundll32.exe	30
PID 2516 wrote to memory of 2860	2516	rundll32.exe	30
PID 2516 wrote to memory of 2860	2516	rundll32.exe	30
PID 2516 wrote to memory of 2860	2516	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e0ff6eb919c6c03b938275834c2c224_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e0ff6eb919c6c03b938275834c2c224_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860

memory/2860-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2860-2-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2860-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download