0574f346b85a4e2dc112d38fc8fbdda9c3ec20db8b81bdf6866e3615b1a93a81

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 03:04

Target

377737596eaa277976edd3420a2f51fd_JaffaCakes118.dll
Size

69KB
MD5

377737596eaa277976edd3420a2f51fd
SHA1

05d753e911b41c7552eccb3c9b0c8abda69741d5
SHA256

0574f346b85a4e2dc112d38fc8fbdda9c3ec20db8b81bdf6866e3615b1a93a81
SHA512

fe84b17c73ad555f82163a50d12643dfdbb010589e6acae593e68fcaa1c3f0a401206a617b171be537e9ab14b6e08f1d5f983ee62a7ceb7d0ad21905a756fa64
SSDEEP

1536:94btVnCbdMMMb/ice+b3/l1PEjfA19xxf0kf:uRdCbeMMs+D//EjobPfhf

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1960-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1960	1688	rundll32.exe	30
PID 1688 wrote to memory of 1960	1688	rundll32.exe	30
PID 1688 wrote to memory of 1960	1688	rundll32.exe	30
PID 1688 wrote to memory of 1960	1688	rundll32.exe	30
PID 1688 wrote to memory of 1960	1688	rundll32.exe	30
PID 1688 wrote to memory of 1960	1688	rundll32.exe	30
PID 1688 wrote to memory of 1960	1688	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\377737596eaa277976edd3420a2f51fd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\377737596eaa277976edd3420a2f51fd_JaffaCakes118.dll,#1
  2⤵
  PID:1960

memory/1960-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download