861867463d8a51185ef83646025ec8ff526b635cd988225e6cdac6375010bbe1

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 20:33

Target

31dfff340c6a244af764c8b8d93d3311_JaffaCakes118.dll
Size

71KB
MD5

31dfff340c6a244af764c8b8d93d3311
SHA1

1afa3108a5d2f1722c3c640de57a0a801d3c42fa
SHA256

861867463d8a51185ef83646025ec8ff526b635cd988225e6cdac6375010bbe1
SHA512

bf696783c34b02409c1d64f6bc62b2c32240c71ff3c93c3cc515f725ff2a2a1748201ab072779bbb6a2d961c83de520e36e8f247b5f40f08d747d1ba37650982
SSDEEP

1536:yl3E0TLktkkrkSCnkXS9eN2mSnir2KybMwpYX:E39skkZCngS9cN1yFbMwq

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2792-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2792	2760	rundll32.exe	31
PID 2760 wrote to memory of 2792	2760	rundll32.exe	31
PID 2760 wrote to memory of 2792	2760	rundll32.exe	31
PID 2760 wrote to memory of 2792	2760	rundll32.exe	31
PID 2760 wrote to memory of 2792	2760	rundll32.exe	31
PID 2760 wrote to memory of 2792	2760	rundll32.exe	31
PID 2760 wrote to memory of 2792	2760	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31dfff340c6a244af764c8b8d93d3311_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31dfff340c6a244af764c8b8d93d3311_JaffaCakes118.dll,#1
  2⤵
  PID:2792

memory/2792-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download