8509ec4fc6f20acce660a1f5684e54fee3e0b41502648a06a41d60767bcf181a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 00:44

Target

3710c5892ee32991ea06ccb691896f8b_JaffaCakes118.dll
Size

98KB
MD5

3710c5892ee32991ea06ccb691896f8b
SHA1

c13f0ce3533034c43b3258dece3a9818b8cfc301
SHA256

8509ec4fc6f20acce660a1f5684e54fee3e0b41502648a06a41d60767bcf181a
SHA512

0f32ec768116fc609d0e93f74ed1f8c50835de46720613eafe2204fea7934886ed2868fa2c55f8bd2a83f6a77aad1a0432973295d87a04f20e5c418ad5b22ee0
SSDEEP

1536:Zn4Mi33LS7enDxB4eJO26Mgz12hhrLRwbf0uzdZzPp3cvEjJ3fIlnq:Zfi3b8enD34+O9MAQhJCIgd5mqJ3onq

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/356-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 356	3036	rundll32.exe	30
PID 3036 wrote to memory of 356	3036	rundll32.exe	30
PID 3036 wrote to memory of 356	3036	rundll32.exe	30
PID 3036 wrote to memory of 356	3036	rundll32.exe	30
PID 3036 wrote to memory of 356	3036	rundll32.exe	30
PID 3036 wrote to memory of 356	3036	rundll32.exe	30
PID 3036 wrote to memory of 356	3036	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3710c5892ee32991ea06ccb691896f8b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3710c5892ee32991ea06ccb691896f8b_JaffaCakes118.dll,#1
  2⤵
  PID:356

memory/356-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download