8df7764602b55a0950373c9359d2dc1007191ba21419e078c0b193f86f95e740

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 20:45

Target

3aa76a33600b96fe1ceb576331460280_JaffaCakes118.dll
Size

31KB
MD5

3aa76a33600b96fe1ceb576331460280
SHA1

4f7f99fbffbf027155516d42d35f68d87b198855
SHA256

8df7764602b55a0950373c9359d2dc1007191ba21419e078c0b193f86f95e740
SHA512

6eb33ff55628f94a2f090654204a76afa6e4cb923e1d1bcab6365089b66d91f94c51931371ef41e18b275e29aeb24316d20ea72cd71b2dddb5889c203ce2032c
SSDEEP

768:8BW/CuJ+LbjM+QmdbHc37RdHUKy4m376:8BUYfM+Qmdjc9f7q76

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2740-0-0x0000000010000000-0x000000001001B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2740	2648	regsvr32.exe	30
PID 2648 wrote to memory of 2740	2648	regsvr32.exe	30
PID 2648 wrote to memory of 2740	2648	regsvr32.exe	30
PID 2648 wrote to memory of 2740	2648	regsvr32.exe	30
PID 2648 wrote to memory of 2740	2648	regsvr32.exe	30
PID 2648 wrote to memory of 2740	2648	regsvr32.exe	30
PID 2648 wrote to memory of 2740	2648	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3aa76a33600b96fe1ceb576331460280_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3aa76a33600b96fe1ceb576331460280_JaffaCakes118.dll
  2⤵
  PID:2740

memory/2740-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download