0f4a60fa505dccaf77c196954bc58af513794b7cdf59db6371e6bba20064fa8a

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 10:39

Target

346212eb06e95e01f2a046eea9864bc8_JaffaCakes118.dll
Size

83KB
MD5

346212eb06e95e01f2a046eea9864bc8
SHA1

43e2381b0b5507bc8fb559465e2bdd46d37557ae
SHA256

0f4a60fa505dccaf77c196954bc58af513794b7cdf59db6371e6bba20064fa8a
SHA512

f4f493ab3cb6871797bceb99b2a8d487a95ac95a2a3967eda5f66fb33092a984da9189129d90ada5b86279d86b23d19e0701bb4060304d47a3e01a3b4e21021a
SSDEEP

1536:Xrj2DTisS3kalQPlpZ7BmIv6f0X4XrW6ta/:v2DTv1alQ9pZ7Lv6c4bda/

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3024-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 3024	1940	rundll32.exe	30
PID 1940 wrote to memory of 3024	1940	rundll32.exe	30
PID 1940 wrote to memory of 3024	1940	rundll32.exe	30
PID 1940 wrote to memory of 3024	1940	rundll32.exe	30
PID 1940 wrote to memory of 3024	1940	rundll32.exe	30
PID 1940 wrote to memory of 3024	1940	rundll32.exe	30
PID 1940 wrote to memory of 3024	1940	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\346212eb06e95e01f2a046eea9864bc8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\346212eb06e95e01f2a046eea9864bc8_JaffaCakes118.dll,#1
  2⤵
  PID:3024

memory/3024-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download