7bde85beeddcc9436c65485a0efa5bd08e52178a38d93c05c2c992d56d239f6f

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 14:21

Target

30bb4970f1c28f97cf363932580700a8_JaffaCakes118.dll
Size

64KB
MD5

30bb4970f1c28f97cf363932580700a8
SHA1

820d204d18eb3750a994ba477b8b8fd6ca0fadc8
SHA256

7bde85beeddcc9436c65485a0efa5bd08e52178a38d93c05c2c992d56d239f6f
SHA512

f2dc75151762c6c2f81f37e48b36d21fbf0b9396e298107175cad81f01c47ce4ef58a49613da89f29c9a3cc269bd2437108e7fee6e0fb95124785632612ab9d0
SSDEEP

1536:ZjZx7Lb2sLnGYJtDd0fHrwkZIt0XY0Jt:1LF1tD4HUkq0XY0

Score

7^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2908-4-0x0000000000170000-0x000000000017D000-memory.dmp	upx
behavioral1/memory/2908-3-0x0000000000170000-0x000000000017D000-memory.dmp	upx
behavioral1/memory/2908-0-0x0000000000170000-0x000000000017D000-memory.dmp	upx
behavioral1/memory/2908-7-0x0000000000170000-0x000000000017D000-memory.dmp	upx
behavioral1/memory/2908-6-0x0000000000170000-0x000000000017D000-memory.dmp	upx
behavioral1/memory/2908-8-0x0000000000170000-0x000000000017D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2908	2488	rundll32.exe	29
PID 2488 wrote to memory of 2908	2488	rundll32.exe	29
PID 2488 wrote to memory of 2908	2488	rundll32.exe	29
PID 2488 wrote to memory of 2908	2488	rundll32.exe	29
PID 2488 wrote to memory of 2908	2488	rundll32.exe	29
PID 2488 wrote to memory of 2908	2488	rundll32.exe	29
PID 2488 wrote to memory of 2908	2488	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\30bb4970f1c28f97cf363932580700a8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\30bb4970f1c28f97cf363932580700a8_JaffaCakes118.dll,#1
  2⤵
  PID:2908

memory/2908-4-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download
memory/2908-3-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download
memory/2908-0-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download
memory/2908-7-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download
memory/2908-6-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download
memory/2908-5-0x0000000000160000-0x0000000000166000-memory.dmp

Filesize
24KB

Download
memory/2908-8-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download