37ef31720e2db21ae9be1148d8916db4d7e3681c1d028f3dc37b01cfd1179fe8

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 20:42

Target

31e75af7491aba8efd7419c514d8bf56_JaffaCakes118.dll
Size

61KB
MD5

31e75af7491aba8efd7419c514d8bf56
SHA1

df51b123283812165f09e07651ca0bde981e7c53
SHA256

37ef31720e2db21ae9be1148d8916db4d7e3681c1d028f3dc37b01cfd1179fe8
SHA512

d23e97f178c6e10c2810bd924d9900bc53f48c490e45994f7093cfbb83afd6fbea4de1ce3c4e383aa09e0fe2d3af6d5c5e9e1105834e4b599aaf0ff8ed86bc93
SSDEEP

1536:mPO6KEVbsVP0grHokAODVGRfbc0mDH33uvTCY9ST:cMEVbsVcsHoqDVGRDJmDXevTCym

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2064-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2064	2476	rundll32.exe	30
PID 2476 wrote to memory of 2064	2476	rundll32.exe	30
PID 2476 wrote to memory of 2064	2476	rundll32.exe	30
PID 2476 wrote to memory of 2064	2476	rundll32.exe	30
PID 2476 wrote to memory of 2064	2476	rundll32.exe	30
PID 2476 wrote to memory of 2064	2476	rundll32.exe	30
PID 2476 wrote to memory of 2064	2476	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31e75af7491aba8efd7419c514d8bf56_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31e75af7491aba8efd7419c514d8bf56_JaffaCakes118.dll,#1
  2⤵
  PID:2064

memory/2064-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download