7099b2a84a42ba17d7c107acf628da8daf2822fa080d5da282fc1c40d9c8eb47

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 14:59

Target

2cc8216c0e59f682c59ad8bc9f4d7a35_JaffaCakes118.dll
Size

123KB
MD5

2cc8216c0e59f682c59ad8bc9f4d7a35
SHA1

79ce397bf7bb85bb69fa61853e8ba16f9f865356
SHA256

7099b2a84a42ba17d7c107acf628da8daf2822fa080d5da282fc1c40d9c8eb47
SHA512

923074203748a60b9bf467eb2520a2a161fb3783190628125b2f046791895fb3e5d799af7be6110a352b4d9917af03fc1afa2b3b57f126b71f8edcb7a82774f8
SSDEEP

1536:qk9sQZTJD+QMfmnhBbgA6U7bVJqBR//xEDYUFHtJzrdoHcJ9pSSLTtuQy+Y8awdd:l9L1xm6hpbVcBtmLzzrdmI9EMix4d

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2192-0-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2192	2432	rundll32.exe	30
PID 2432 wrote to memory of 2192	2432	rundll32.exe	30
PID 2432 wrote to memory of 2192	2432	rundll32.exe	30
PID 2432 wrote to memory of 2192	2432	rundll32.exe	30
PID 2432 wrote to memory of 2192	2432	rundll32.exe	30
PID 2432 wrote to memory of 2192	2432	rundll32.exe	30
PID 2432 wrote to memory of 2192	2432	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cc8216c0e59f682c59ad8bc9f4d7a35_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cc8216c0e59f682c59ad8bc9f4d7a35_JaffaCakes118.dll,#1
  2⤵
  PID:2192

memory/2192-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download