4051a2fe420b5dfd48bf016df9cf0b8f078083ff3a667f8409c9360b0d86dd09

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 12:12

Target

39108cbb6a1790ddad8524921df361db_JaffaCakes118.dll
Size

61KB
MD5

39108cbb6a1790ddad8524921df361db
SHA1

c589ce901d4b361ccc7022a93eab1d49bfeb645c
SHA256

4051a2fe420b5dfd48bf016df9cf0b8f078083ff3a667f8409c9360b0d86dd09
SHA512

1d3b2e2eac0fdd0376a81edfd3c694cfeddb57daf87d83b1c01f0baba8a513351bcef8cfc7f0a535d19bf3696a0a6d1fa630292f89a3cfebcd3a246dbda7b328
SSDEEP

1536:GtfMOSJ/Yzbr0DMr+BH20dqQdF+DDh58u8:GSOS5Yg120dqYF+DDh5H8

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1912-0-0x0000000010000000-0x000000001002C000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1912	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1912	1700	rundll32.exe	31
PID 1700 wrote to memory of 1912	1700	rundll32.exe	31
PID 1700 wrote to memory of 1912	1700	rundll32.exe	31
PID 1700 wrote to memory of 1912	1700	rundll32.exe	31
PID 1700 wrote to memory of 1912	1700	rundll32.exe	31
PID 1700 wrote to memory of 1912	1700	rundll32.exe	31
PID 1700 wrote to memory of 1912	1700	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39108cbb6a1790ddad8524921df361db_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39108cbb6a1790ddad8524921df361db_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1912

memory/1912-0-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download