816c5a00a158da5b79a63d90a2a90790a968d4bd78ed517a297310cd1e9d6a9f

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 12:16

Target

34ade5d000c912215286120c75b36734_JaffaCakes118.dll
Size

70KB
MD5

34ade5d000c912215286120c75b36734
SHA1

73f54f8288785d3eaa633b1d5a7f495685e374c4
SHA256

816c5a00a158da5b79a63d90a2a90790a968d4bd78ed517a297310cd1e9d6a9f
SHA512

51e69a1bb5a32c1d9383b4ce8e00457af0e65cd48d5c7cd83f67c4a693c897466afd21af31949e681065714c5e7d6b083695ec388e2314a55c836df2a3b86c53
SSDEEP

1536:RVTrmcyifwWFwS7WuDl0D+AWDaXhjsj+e8cqenUi:TGcyi7W22Ve4sSVcqen

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3004-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 3004	2996	rundll32.exe	30
PID 2996 wrote to memory of 3004	2996	rundll32.exe	30
PID 2996 wrote to memory of 3004	2996	rundll32.exe	30
PID 2996 wrote to memory of 3004	2996	rundll32.exe	30
PID 2996 wrote to memory of 3004	2996	rundll32.exe	30
PID 2996 wrote to memory of 3004	2996	rundll32.exe	30
PID 2996 wrote to memory of 3004	2996	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\34ade5d000c912215286120c75b36734_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\34ade5d000c912215286120c75b36734_JaffaCakes118.dll,#1
  2⤵
  PID:3004

memory/3004-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download