0497431a6b13be5849e754f13df71dbf7b2c7fc31e04e99879275d8b719e11a1

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 17:23

Target

2d312d39d2d54b5db0cea93093e9eedd_JaffaCakes118.dll
Size

91KB
MD5

2d312d39d2d54b5db0cea93093e9eedd
SHA1

6c190973bdcc89e0287d4782f2f855803e79725f
SHA256

0497431a6b13be5849e754f13df71dbf7b2c7fc31e04e99879275d8b719e11a1
SHA512

25473060c31f377f001cbaeb147bd668f27311941f4a56d2201d38910605005aa95be069d1a4df1532badc31551793b9b29efcdc2c9c2903b2804897e69a03ae
SSDEEP

1536:UaW3MNZo4ppBquHn4msdehgdm/cwqE84jDa6Ir47d60FgT9xH09sQcatvPSnAQSv:1sMNZo4ppIfRm/cr/4CVr4xyT9xH09ZP

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2560-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2560-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 2560	1528	rundll32.exe	30
PID 1528 wrote to memory of 2560	1528	rundll32.exe	30
PID 1528 wrote to memory of 2560	1528	rundll32.exe	30
PID 1528 wrote to memory of 2560	1528	rundll32.exe	30
PID 1528 wrote to memory of 2560	1528	rundll32.exe	30
PID 1528 wrote to memory of 2560	1528	rundll32.exe	30
PID 1528 wrote to memory of 2560	1528	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d312d39d2d54b5db0cea93093e9eedd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d312d39d2d54b5db0cea93093e9eedd_JaffaCakes118.dll,#1
  2⤵
  PID:2560

memory/2560-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2560-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download