80d5d7028b2e0b736f03cc43b347f416f3c65d1576f84a85e5aabb16f52592d8

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 03:54

Target

33350ca6c12540812d8d9c7d823aa6a4_JaffaCakes118.dll
Size

83KB
MD5

33350ca6c12540812d8d9c7d823aa6a4
SHA1

3486ef7ebac82bcd807dd395d279f47122b3bad1
SHA256

80d5d7028b2e0b736f03cc43b347f416f3c65d1576f84a85e5aabb16f52592d8
SHA512

9e0842ee0e2866775b0aab3dd2126b95ea3c08d812a3d8c9b7dea9973996b2f0acb01b1900ae63e2078dbcbe9d96da0bfab3081bc1e59d38967e5dda7dec0335
SSDEEP

1536:5HpeS2KXh9tDvXtz+Xv9egoLCLVNpxlqrcnwZIMBkeDG6ZE:5D2KXtD/F+gCpXecwZfB1DXZ

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2100-0-0x0000000000210000-0x000000000021E000-memory.dmp	upx
behavioral1/memory/2100-4-0x0000000000210000-0x000000000021E000-memory.dmp	upx
behavioral1/memory/2100-3-0x0000000000210000-0x000000000021E000-memory.dmp	upx
behavioral1/memory/2100-7-0x0000000000210000-0x000000000021E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2100	2000	rundll32.exe	30
PID 2000 wrote to memory of 2100	2000	rundll32.exe	30
PID 2000 wrote to memory of 2100	2000	rundll32.exe	30
PID 2000 wrote to memory of 2100	2000	rundll32.exe	30
PID 2000 wrote to memory of 2100	2000	rundll32.exe	30
PID 2000 wrote to memory of 2100	2000	rundll32.exe	30
PID 2000 wrote to memory of 2100	2000	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33350ca6c12540812d8d9c7d823aa6a4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33350ca6c12540812d8d9c7d823aa6a4_JaffaCakes118.dll,#1
  2⤵
  PID:2100

memory/2100-0-0x0000000000210000-0x000000000021E000-memory.dmp

Filesize
56KB

Download
memory/2100-4-0x0000000000210000-0x000000000021E000-memory.dmp

Filesize
56KB

Download
memory/2100-3-0x0000000000210000-0x000000000021E000-memory.dmp

Filesize
56KB

Download
memory/2100-7-0x0000000000210000-0x000000000021E000-memory.dmp

Filesize
56KB

Download
memory/2100-6-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2100-5-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download