c6b8bd8ab2006ef66089baff35ce9b239701179c7209d784dc51c7fc4c94f53c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 14:55

Target

2cc58c75d4bb9a9859287aa0f5aeef6f_JaffaCakes118.dll
Size

8KB
MD5

2cc58c75d4bb9a9859287aa0f5aeef6f
SHA1

faef5e9cd177d8c82f4019c604d1368a4ec430c7
SHA256

c6b8bd8ab2006ef66089baff35ce9b239701179c7209d784dc51c7fc4c94f53c
SHA512

ca1b55806c0bace0d6c3981f30b0dadbd9d636184c91013c6b110e996c42a02fd17a15b48f2aab56b8099afc652e304c19a6cf3a87f4fa31072e3c8161472928
SSDEEP

96:Xcjj5wbSiAj89bdb/S8q8QZLQvqniAZHeTwGK7ZAsFxgq5ZUKFhlmWWvTWwa:P+90RbS8qzniqA9K7ZhFxPJhTW7W

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3040-0-0x0000000010000000-0x000000001000A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 3040	1224	rundll32.exe	30
PID 1224 wrote to memory of 3040	1224	rundll32.exe	30
PID 1224 wrote to memory of 3040	1224	rundll32.exe	30
PID 1224 wrote to memory of 3040	1224	rundll32.exe	30
PID 1224 wrote to memory of 3040	1224	rundll32.exe	30
PID 1224 wrote to memory of 3040	1224	rundll32.exe	30
PID 1224 wrote to memory of 3040	1224	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cc58c75d4bb9a9859287aa0f5aeef6f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cc58c75d4bb9a9859287aa0f5aeef6f_JaffaCakes118.dll,#1
  2⤵
  PID:3040

memory/3040-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download