8648ebde5d5a0f48ba9902f42e59c727e55d5c7c91881175bfc536a5006e2ef7

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 18:34

Target

35e5ce2a253aeefacb8953fd2d506205_JaffaCakes118.dll
Size

63KB
MD5

35e5ce2a253aeefacb8953fd2d506205
SHA1

1b085fe0033814d57f1984099300c3b9fac7723e
SHA256

8648ebde5d5a0f48ba9902f42e59c727e55d5c7c91881175bfc536a5006e2ef7
SHA512

de24aa7b2c6c5ae98d6f450f9f5a54a6db526bf383bb3c6d6f84003352af51e59fa72594446dfc6cc9fed823aa97d2ccb137f16d1e74364d7ae37af3ff14b69c
SSDEEP

1536:hXGa7ReQC1WrgiB98r20liGAoDG6qELc5MyBh:r7RCUN7Qpe7MLcp

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2756-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2756	2656	rundll32.exe	30
PID 2656 wrote to memory of 2756	2656	rundll32.exe	30
PID 2656 wrote to memory of 2756	2656	rundll32.exe	30
PID 2656 wrote to memory of 2756	2656	rundll32.exe	30
PID 2656 wrote to memory of 2756	2656	rundll32.exe	30
PID 2656 wrote to memory of 2756	2656	rundll32.exe	30
PID 2656 wrote to memory of 2756	2656	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35e5ce2a253aeefacb8953fd2d506205_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\35e5ce2a253aeefacb8953fd2d506205_JaffaCakes118.dll,#1
  2⤵
  PID:2756

memory/2756-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download