0b360e1718039c2b5b68dd9e2a806639f4a5d2e939fc7dd075b3c44eb9ec211a

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 06:18

Target

339f28909529a7334442a1550714c6a2_JaffaCakes118.dll
Size

40KB
MD5

339f28909529a7334442a1550714c6a2
SHA1

ed784420555691878ac86c3825770cbe36d26b54
SHA256

0b360e1718039c2b5b68dd9e2a806639f4a5d2e939fc7dd075b3c44eb9ec211a
SHA512

2bd50026a2b1a4ea4a316f33b3efb842a05035c55cc38d767848650703bffff61f09c21352d25e6842a9b38ea6d2764f1dd0e63e698683389d3f2bd0c90e6073
SSDEEP

768:szM2xVV8c57sgQFtbCGBDI8IjxGQAX0+S/pdmBFy5tJhZe9K4VAhUmwNl:V2bCckttMtjx5M2pd2FatXUs4GhM7

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2528-0-0x0000000010000000-0x000000001000A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2528	1952	rundll32.exe	31
PID 1952 wrote to memory of 2528	1952	rundll32.exe	31
PID 1952 wrote to memory of 2528	1952	rundll32.exe	31
PID 1952 wrote to memory of 2528	1952	rundll32.exe	31
PID 1952 wrote to memory of 2528	1952	rundll32.exe	31
PID 1952 wrote to memory of 2528	1952	rundll32.exe	31
PID 1952 wrote to memory of 2528	1952	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\339f28909529a7334442a1550714c6a2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\339f28909529a7334442a1550714c6a2_JaffaCakes118.dll,#1
  2⤵
  PID:2528

memory/2528-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download