30a850f0573522006ff29ba6972e316b8c58ccad96b8da295518906f64254a58

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 13:45

Target

309eeb2402c0d04705a6ef03eb090d94_JaffaCakes118.dll
Size

217KB
MD5

309eeb2402c0d04705a6ef03eb090d94
SHA1

cd6d455f1b8b9b5ea37f1e5f01116ace3df533bf
SHA256

30a850f0573522006ff29ba6972e316b8c58ccad96b8da295518906f64254a58
SHA512

abcea6f1ff9597f8a3c06aaea2fd5c4fa1d991465de25fe10b4c184bc2c950de402db3b62e5fb1affe9d5752c1e1accbafe6f9668cf6bd5a25a2be85c86af795
SSDEEP

384:ogaUwAW/SGoUPWhS3YzXv0ysk3dI1gNi/rKUQYd61fIBC:TwAaSGoUPWo3iv8kNIgY/+Tt

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1932-0-0x0000000010000000-0x0000000010011000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1932	2072	rundll32.exe	31
PID 2072 wrote to memory of 1932	2072	rundll32.exe	31
PID 2072 wrote to memory of 1932	2072	rundll32.exe	31
PID 2072 wrote to memory of 1932	2072	rundll32.exe	31
PID 2072 wrote to memory of 1932	2072	rundll32.exe	31
PID 2072 wrote to memory of 1932	2072	rundll32.exe	31
PID 2072 wrote to memory of 1932	2072	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\309eeb2402c0d04705a6ef03eb090d94_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\309eeb2402c0d04705a6ef03eb090d94_JaffaCakes118.dll,#1
  2⤵
  PID:1932

memory/1932-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download