258ba6f7070d0fecc9c3949460b71d7cf874a062e353640dc4d29b243c4ddcdf

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 09:33

Target

2fd5cb7cdda868816d03f1a30a720bfb_JaffaCakes118.dll
Size

52KB
MD5

2fd5cb7cdda868816d03f1a30a720bfb
SHA1

b092f46575060e9a2041b9218856d054ac74353f
SHA256

258ba6f7070d0fecc9c3949460b71d7cf874a062e353640dc4d29b243c4ddcdf
SHA512

c6b26767ade9cec3df49a2be821848334929e3f84c969cc8de8f3869b29c4756863e5684c23f7f68da81de086b66f35716cc6d33bd8e0f19f619ce8558d6a647
SSDEEP

1536:yHZTeUzIUNZK0Yqiiy++1LPknpoEygRByUSnSvumh:yHlerU3Kiy+S8nwBnpmh

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1528-1-0x0000000010000000-0x000000001000D000-memory.dmp	upx
behavioral1/memory/1528-2-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1528	2372	rundll32.exe	30
PID 2372 wrote to memory of 1528	2372	rundll32.exe	30
PID 2372 wrote to memory of 1528	2372	rundll32.exe	30
PID 2372 wrote to memory of 1528	2372	rundll32.exe	30
PID 2372 wrote to memory of 1528	2372	rundll32.exe	30
PID 2372 wrote to memory of 1528	2372	rundll32.exe	30
PID 2372 wrote to memory of 1528	2372	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fd5cb7cdda868816d03f1a30a720bfb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fd5cb7cdda868816d03f1a30a720bfb_JaffaCakes118.dll,#1
  2⤵
  PID:1528

memory/1528-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1528-2-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1528-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download