b1568e22a527fce2dc294e36ceb2c3fda8ffdb1dd2d21c76af31719c64ebaa32

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 10:14

Target

2bf1f6342c043d6b652b98413bbb4135_JaffaCakes118.dll
Size

62KB
MD5

2bf1f6342c043d6b652b98413bbb4135
SHA1

2ef77a46f2845135e1c39ef8724c1570765d05cb
SHA256

b1568e22a527fce2dc294e36ceb2c3fda8ffdb1dd2d21c76af31719c64ebaa32
SHA512

cfec08d49e3391f6d6b19e7a44a7d7bcbac75e4c23d55de1f5d54e99bd1dfe415a91d21d8749efcc8b7f23b174a3424032f6986cc66558ca1db1bc8a95a6445c
SSDEEP

1536:V8O9Nn6Rjriy/GdT8kcuuRUtWh8vPcVyE8V9mPdv9nivfHWg3:2Oz6VWye+jRNd8V9mVv9niXHWg3

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2636-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2636	2672	rundll32.exe	30
PID 2672 wrote to memory of 2636	2672	rundll32.exe	30
PID 2672 wrote to memory of 2636	2672	rundll32.exe	30
PID 2672 wrote to memory of 2636	2672	rundll32.exe	30
PID 2672 wrote to memory of 2636	2672	rundll32.exe	30
PID 2672 wrote to memory of 2636	2672	rundll32.exe	30
PID 2672 wrote to memory of 2636	2672	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bf1f6342c043d6b652b98413bbb4135_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bf1f6342c043d6b652b98413bbb4135_JaffaCakes118.dll,#1
  2⤵
  PID:2636

memory/2636-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download