e6d535a8cbab84240a0d26c54fde363498ea5eaae0e86a0845146df8e1199942

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 18:08

Target

3e582f0b63635f6061400e280818bade_JaffaCakes118.dll
Size

86KB
MD5

3e582f0b63635f6061400e280818bade
SHA1

af6f8e4b9c5a5708e64f5c53aa38f10a8ef430a6
SHA256

e6d535a8cbab84240a0d26c54fde363498ea5eaae0e86a0845146df8e1199942
SHA512

78b267b340cd818c49efa0163175ce707e856f7f0258460dc81fa3ebf33f6ee1b48603d0ccc81aa94ea1ef481185a702ec1c76ce419355b9db1add6f9c785d0b
SSDEEP

1536:/KfW2n5ck20WH5TMKE4vFdGbYhudMK0IfFjSiVpV6+KENEXOX7Tb6whib8K4jHY7:/KhnU0WZTMwPOMNIdSIpK28OLTbThw4a

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2656-1-0x0000000010000000-0x000000001002E000-memory.dmp	upx
behavioral1/memory/2656-3-0x0000000010000000-0x000000001002E000-memory.dmp	upx
behavioral1/memory/2656-2-0x0000000010000000-0x000000001002E000-memory.dmp	upx
behavioral1/memory/2656-0-0x0000000010000000-0x000000001002E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2656	2636	rundll32.exe	30
PID 2636 wrote to memory of 2656	2636	rundll32.exe	30
PID 2636 wrote to memory of 2656	2636	rundll32.exe	30
PID 2636 wrote to memory of 2656	2636	rundll32.exe	30
PID 2636 wrote to memory of 2656	2636	rundll32.exe	30
PID 2636 wrote to memory of 2656	2636	rundll32.exe	30
PID 2636 wrote to memory of 2656	2636	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e582f0b63635f6061400e280818bade_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e582f0b63635f6061400e280818bade_JaffaCakes118.dll,#1
  2⤵
  PID:2656

memory/2656-1-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/2656-3-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/2656-2-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/2656-0-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download