ca6ce610a08ac84fd0a7d32b8876226b5e0533f46fb132dd83d0c831a83e4f15

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 13:38

Target

3d98a6743e5aae9c304117d02d3b804e_JaffaCakes118.dll
Size

66KB
MD5

3d98a6743e5aae9c304117d02d3b804e
SHA1

78c7b6f8694292b1a718c29a987b6e5bf7c30ebd
SHA256

ca6ce610a08ac84fd0a7d32b8876226b5e0533f46fb132dd83d0c831a83e4f15
SHA512

231ed1031e6b2c660646334c8dabf55294eb2ada9163a61055b53ea4046e6a0c0e6000097d54be5a8388a154e8c7e197b146e3c9978f6770e34a3e57168a09ba
SSDEEP

1536:5K5xXZQgIfVDF2T2b+a727nNeYS5LkN/rN+pW:5Knagp0XqZeYSRkNRUW

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2592-2-0x0000000010000000-0x0000000010042000-memory.dmp	upx
behavioral1/memory/2592-1-0x0000000010000000-0x0000000010042000-memory.dmp	upx
behavioral1/memory/2592-0-0x0000000010000000-0x0000000010042000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2592	2568	rundll32.exe	30
PID 2568 wrote to memory of 2592	2568	rundll32.exe	30
PID 2568 wrote to memory of 2592	2568	rundll32.exe	30
PID 2568 wrote to memory of 2592	2568	rundll32.exe	30
PID 2568 wrote to memory of 2592	2568	rundll32.exe	30
PID 2568 wrote to memory of 2592	2568	rundll32.exe	30
PID 2568 wrote to memory of 2592	2568	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d98a6743e5aae9c304117d02d3b804e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d98a6743e5aae9c304117d02d3b804e_JaffaCakes118.dll,#1
  2⤵
  PID:2592

memory/2592-2-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download
memory/2592-1-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download
memory/2592-0-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download