dabd6a935b6d0d0f8d9f038f6cfd3d52a40fe77991578801bf119108eaa78fa6

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 08:27

Target

2ba613dee9f62dede8cb4e65bcaa1a2b_JaffaCakes118.dll
Size

75KB
MD5

2ba613dee9f62dede8cb4e65bcaa1a2b
SHA1

0c4fabee507d84f3d0b0de7d640c3b95b2d63ed4
SHA256

dabd6a935b6d0d0f8d9f038f6cfd3d52a40fe77991578801bf119108eaa78fa6
SHA512

b5e2655198ac3a9154beaf843bdd36f103a089ac7483afbe6d479a4d9c8386aa732e288002a88f7f258de8ca9651fbff4df174ccb315c34584d258735da94cc2
SSDEEP

1536:hXGa7ReQCglZgAbPxnV8AkNb48ylc31ywdmvp:r7RCglKAbZ6AebbscJda

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2912-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2912	2960	rundll32.exe	30
PID 2960 wrote to memory of 2912	2960	rundll32.exe	30
PID 2960 wrote to memory of 2912	2960	rundll32.exe	30
PID 2960 wrote to memory of 2912	2960	rundll32.exe	30
PID 2960 wrote to memory of 2912	2960	rundll32.exe	30
PID 2960 wrote to memory of 2912	2960	rundll32.exe	30
PID 2960 wrote to memory of 2912	2960	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ba613dee9f62dede8cb4e65bcaa1a2b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ba613dee9f62dede8cb4e65bcaa1a2b_JaffaCakes118.dll,#1
  2⤵
  PID:2912

memory/2912-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download