a33d0edb377153aefbc274cc65c3bc2b73b07aeb6f472cc9a09c8522fdc3c7e3

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 12:36

Target

34be91a69250a2d45a597ebb6aafb124_JaffaCakes118.dll
Size

167KB
MD5

34be91a69250a2d45a597ebb6aafb124
SHA1

ebabd5a968ae89b427bf5bfc3e65117a0a80310d
SHA256

a33d0edb377153aefbc274cc65c3bc2b73b07aeb6f472cc9a09c8522fdc3c7e3
SHA512

0e8eef168465422d82650d0255d49a9861641d545cf1b3b8974cf0a5fe36b447780e072bacf17f247cf64f22beaa6739a81646d49aa7d1a4b766f1a1cf5e3b92
SSDEEP

1536:zjiYTvahDbhmU50YZtZ3DLKY7X0FdLBqBv7d8m7KCS92MGLRqs9MH9PbT7tz6PCn:zOsyhD75x3aYLakAa4qLsYM5bho

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1628-0-0x0000000000740000-0x00000000007C0000-memory.dmp	upx
behavioral1/memory/1628-2-0x0000000000740000-0x00000000007C0000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1628	1948	regsvr32.exe	30
PID 1948 wrote to memory of 1628	1948	regsvr32.exe	30
PID 1948 wrote to memory of 1628	1948	regsvr32.exe	30
PID 1948 wrote to memory of 1628	1948	regsvr32.exe	30
PID 1948 wrote to memory of 1628	1948	regsvr32.exe	30
PID 1948 wrote to memory of 1628	1948	regsvr32.exe	30
PID 1948 wrote to memory of 1628	1948	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\34be91a69250a2d45a597ebb6aafb124_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\34be91a69250a2d45a597ebb6aafb124_JaffaCakes118.dll
  2⤵
  PID:1628

memory/1628-0-0x0000000000740000-0x00000000007C0000-memory.dmp

Filesize
512KB

Download
memory/1628-2-0x0000000000740000-0x00000000007C0000-memory.dmp

Filesize
512KB

Download
memory/1628-1-0x0000000000250000-0x0000000000296000-memory.dmp

Filesize
280KB

Download