a4957602d73f7ca4843d701290c36becd7ccdc2e263059c6e4b643d1c7582907

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 17:42

Target

3e46bef8bd8d8abbee3099530adfa950_JaffaCakes118.dll
Size

68KB
MD5

3e46bef8bd8d8abbee3099530adfa950
SHA1

1c09795540bd812093d2b8b75f24ddba0fc8c0dc
SHA256

a4957602d73f7ca4843d701290c36becd7ccdc2e263059c6e4b643d1c7582907
SHA512

3bd7d5be72a1f79630389f3fc27275d8024d5205246f05fdfeceb28e8a4852778f2b523b445ca47ba1a7bf96d9c15b3e863f47299831035d6da116cf3f90c75b
SSDEEP

1536:0UIsMWwFBE8P3WhH4EMFTCDktnCJiFXoJOHGsEjD56Zjz/Z8:55DwFC8DEMNCDwn44XoJuGsEny3/u

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1200-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 1200	2976	rundll32.exe	30
PID 2976 wrote to memory of 1200	2976	rundll32.exe	30
PID 2976 wrote to memory of 1200	2976	rundll32.exe	30
PID 2976 wrote to memory of 1200	2976	rundll32.exe	30
PID 2976 wrote to memory of 1200	2976	rundll32.exe	30
PID 2976 wrote to memory of 1200	2976	rundll32.exe	30
PID 2976 wrote to memory of 1200	2976	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e46bef8bd8d8abbee3099530adfa950_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e46bef8bd8d8abbee3099530adfa950_JaffaCakes118.dll,#1
  2⤵
  PID:1200

memory/1200-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download