f8a9646b2589bf5e9d91a9c81aff58967b7d3b347d4e2168a29c8e6481b8ea73

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 05:12

Target

37d38fab52dba55e527ff13f10aecbf8_JaffaCakes118.dll
Size

99KB
MD5

37d38fab52dba55e527ff13f10aecbf8
SHA1

f015a11aefa384d3e27c5f1ba619c097d3803265
SHA256

f8a9646b2589bf5e9d91a9c81aff58967b7d3b347d4e2168a29c8e6481b8ea73
SHA512

847752d60f16237b5b3aeb9180ef4cf16786a0dfdcb282994fe3535553a0cf39e6b325f2d44199eade2f5a798be8ed415851aa64d9d70ad6e5f4634fac64a650
SSDEEP

1536:4G3uk8hPgcW3cunhBbgA6Ut5v8Lte9QQszmSa/hHoG9t9n:13sL6Dh75v8Zx3aFX9n

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1736-0-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 1736	2064	rundll32.exe	30
PID 2064 wrote to memory of 1736	2064	rundll32.exe	30
PID 2064 wrote to memory of 1736	2064	rundll32.exe	30
PID 2064 wrote to memory of 1736	2064	rundll32.exe	30
PID 2064 wrote to memory of 1736	2064	rundll32.exe	30
PID 2064 wrote to memory of 1736	2064	rundll32.exe	30
PID 2064 wrote to memory of 1736	2064	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\37d38fab52dba55e527ff13f10aecbf8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\37d38fab52dba55e527ff13f10aecbf8_JaffaCakes118.dll,#1
  2⤵
  PID:1736

memory/1736-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download