945f5269c077f49ea221e54cca2d3635704336a72240d869a77bbdb796cb2e7c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 16:17

Target

39db4db5992df124f139e4bfb940b9a4_JaffaCakes118.dll
Size

1.7MB
MD5

39db4db5992df124f139e4bfb940b9a4
SHA1

5eaba4919971c09264ac50018b61dc276fb6b709
SHA256

945f5269c077f49ea221e54cca2d3635704336a72240d869a77bbdb796cb2e7c
SHA512

a277babfafe15fe19ea35435bb471a29475d35a6cd5a722082d6e4ffa0786b059534e01f2578fa7ef5688c24efb82ae2c2c38a70dd086d09fe853778357e332f
SSDEEP

24576:2R3XdK55EIK281H2ijFi98NrwnR9vW1T/GKILEhIEaFZAeVCVmsr8tsXGPKQGB3c:2ZdjXXVxiKNknR9vWhGyevNS

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2688-1-0x0000000074650000-0x000000007483A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 2688	1240	rundll32.exe	30
PID 1240 wrote to memory of 2688	1240	rundll32.exe	30
PID 1240 wrote to memory of 2688	1240	rundll32.exe	30
PID 1240 wrote to memory of 2688	1240	rundll32.exe	30
PID 1240 wrote to memory of 2688	1240	rundll32.exe	30
PID 1240 wrote to memory of 2688	1240	rundll32.exe	30
PID 1240 wrote to memory of 2688	1240	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39db4db5992df124f139e4bfb940b9a4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39db4db5992df124f139e4bfb940b9a4_JaffaCakes118.dll,#1
  2⤵
  PID:2688

memory/2688-0-0x0000000000100000-0x0000000000105000-memory.dmp

Filesize
20KB

Download
memory/2688-1-0x0000000074650000-0x000000007483A000-memory.dmp

Filesize
1.9MB

Download
memory/2688-2-0x0000000074650000-0x000000007483A000-memory.dmp

Filesize
1.9MB

Download