810334b1ab32c522aacd0f2313e3c5cead2b4bb66fa1c2f3c7cfe8a73f9a001d

Analysis

max time kernel
13s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 15:24

Target

39af2dc0194618e8e6553570d4139aac_JaffaCakes118.dll
Size

88KB
MD5

39af2dc0194618e8e6553570d4139aac
SHA1

7b682f99016023803c7dac6c7e7b8b2be2ea11b0
SHA256

810334b1ab32c522aacd0f2313e3c5cead2b4bb66fa1c2f3c7cfe8a73f9a001d
SHA512

c980444a658d056b221e4a964e01b4efff34636aad5fc0ac371e08d8fb97fc41f462a18fc3f9c94e684106271449ee3e365e5c4a2209a73c594583ed6f722a64
SSDEEP

1536:J3iyDPFw2bprmjUmq1AnNkc0tyUc/+XFbJ9dq16V:1Tw2bpCK1AnNn0t92+VbDdq16V

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1100-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 1100	2552	rundll32.exe	29
PID 2552 wrote to memory of 1100	2552	rundll32.exe	29
PID 2552 wrote to memory of 1100	2552	rundll32.exe	29
PID 2552 wrote to memory of 1100	2552	rundll32.exe	29
PID 2552 wrote to memory of 1100	2552	rundll32.exe	29
PID 2552 wrote to memory of 1100	2552	rundll32.exe	29
PID 2552 wrote to memory of 1100	2552	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39af2dc0194618e8e6553570d4139aac_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39af2dc0194618e8e6553570d4139aac_JaffaCakes118.dll,#1
  2⤵
  PID:1100

memory/1100-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download