2368b23e5055c448d1c0addf9acbe3b251d0e1fe6a5dc40f08807f23a377bca2

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 10:06

Target

38ae57278053a270979357f5c9e5019b_JaffaCakes118.dll
Size

55KB
MD5

38ae57278053a270979357f5c9e5019b
SHA1

03fb174532c05ef37c9e40e9030239a1763fed48
SHA256

2368b23e5055c448d1c0addf9acbe3b251d0e1fe6a5dc40f08807f23a377bca2
SHA512

71b9bf4798e7e4a1d5fedc7e6707d6231480587470c5af6495f798233818a85a4c5de69db294a2f9f589aa6715760de31bbb41336eca42cdc31a246b19524499
SSDEEP

768:OhBbrk2YXYADCbi/caPmC3ylQJ0DM+ZsmkrsAARgLsSiUn3EOLvu62Zi0oICbOpN:sBfn+dDCW/whDLs75sBU08ai0oICKb

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2696-0-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2696	2664	rundll32.exe	30
PID 2664 wrote to memory of 2696	2664	rundll32.exe	30
PID 2664 wrote to memory of 2696	2664	rundll32.exe	30
PID 2664 wrote to memory of 2696	2664	rundll32.exe	30
PID 2664 wrote to memory of 2696	2664	rundll32.exe	30
PID 2664 wrote to memory of 2696	2664	rundll32.exe	30
PID 2664 wrote to memory of 2696	2664	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38ae57278053a270979357f5c9e5019b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38ae57278053a270979357f5c9e5019b_JaffaCakes118.dll,#1
  2⤵
  PID:2696

memory/2696-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download