ce7bc210779989a9b5fad9d1b7b8c53d6fba37614b8387d1327958f14a311c15

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 17:04

Target

3e2aab25fff0529721eb8a12b341b5af_JaffaCakes118.dll
Size

278KB
MD5

3e2aab25fff0529721eb8a12b341b5af
SHA1

16bc9431575411fd35ff25c5024fca4873d26dcb
SHA256

ce7bc210779989a9b5fad9d1b7b8c53d6fba37614b8387d1327958f14a311c15
SHA512

debc46701653d0a6eb357d6e7572cb898a06eff16730fff3e913923e263848be1b45c04a727450816b92e2e7a751d216ae86e308ae280b81ebbf42244a8487f2
SSDEEP

6144:1ZFh/0bKu7ZcD0wEaoX/OPthW+fmAWgWVKFl0xsDNmtZ0Kaw7t83/MqLscoS+:DEZcDP2UH3ZRl7sqwR05LscoS+

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2364-0-0x0000000010000000-0x00000000100A2000-memory.dmp	upx
behavioral1/memory/2364-2-0x0000000010000000-0x00000000100A2000-memory.dmp	upx
behavioral1/memory/2364-1-0x0000000010000000-0x00000000100A2000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2364	3020	rundll32.exe	30
PID 3020 wrote to memory of 2364	3020	rundll32.exe	30
PID 3020 wrote to memory of 2364	3020	rundll32.exe	30
PID 3020 wrote to memory of 2364	3020	rundll32.exe	30
PID 3020 wrote to memory of 2364	3020	rundll32.exe	30
PID 3020 wrote to memory of 2364	3020	rundll32.exe	30
PID 3020 wrote to memory of 2364	3020	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e2aab25fff0529721eb8a12b341b5af_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e2aab25fff0529721eb8a12b341b5af_JaffaCakes118.dll,#1
  2⤵
  PID:2364

memory/2364-0-0x0000000010000000-0x00000000100A2000-memory.dmp

Filesize
648KB

Download
memory/2364-3-0x0000000010000000-0x00000000100A2000-memory.dmp

Filesize
648KB

Download
memory/2364-2-0x0000000010000000-0x00000000100A2000-memory.dmp

Filesize
648KB

Download
memory/2364-1-0x0000000010000000-0x00000000100A2000-memory.dmp

Filesize
648KB

Download