91fef89d937b9a8c683d9ea6bc35cb53fb8fa0e1c65f2f997a66718f901c151e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 07:01

Target

3c65e9813ea75b2f0d926cc775cf8e14_JaffaCakes118.dll
Size

10KB
MD5

3c65e9813ea75b2f0d926cc775cf8e14
SHA1

429e6a337bdcfa9940fa5cd2dc115de3ac614a3d
SHA256

91fef89d937b9a8c683d9ea6bc35cb53fb8fa0e1c65f2f997a66718f901c151e
SHA512

4bd3542da4a58416508a46a25703a0f40fe47c4c60b9e8b1e5072b9edb0c71469e96cae64b6559c31573a760b7fa54f12e80187f1e3e91525258bd4b894a8758
SSDEEP

192:6PCOB2aWRxqSzBzcSsTfYPzKfV1GSDEOG2tsSKsOFQ:6PQRx4S+GKd1nETS

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2812-0-0x0000000010000000-0x000000001000B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2812	2976	rundll32.exe	30
PID 2976 wrote to memory of 2812	2976	rundll32.exe	30
PID 2976 wrote to memory of 2812	2976	rundll32.exe	30
PID 2976 wrote to memory of 2812	2976	rundll32.exe	30
PID 2976 wrote to memory of 2812	2976	rundll32.exe	30
PID 2976 wrote to memory of 2812	2976	rundll32.exe	30
PID 2976 wrote to memory of 2812	2976	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c65e9813ea75b2f0d926cc775cf8e14_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c65e9813ea75b2f0d926cc775cf8e14_JaffaCakes118.dll,#1
  2⤵
  PID:2812

memory/2812-0-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/2812-3-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/2812-2-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/2812-1-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download