2aef1d72ce41c573076064d32d0b73fa095e7bf4d1ef770690138fce337f782c

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 07:03

Target

40a9200d7f60be24934c1ee42fd97aa1_JaffaCakes118.dll
Size

75KB
MD5

40a9200d7f60be24934c1ee42fd97aa1
SHA1

68d0f519748bf507a5fc54912ceb3e98d383ce94
SHA256

2aef1d72ce41c573076064d32d0b73fa095e7bf4d1ef770690138fce337f782c
SHA512

7d035d8d89a394c3446d5b3de3da7a3d6b7ec9a964efdf621ddc28d202a6569f678cb047168d1600018b1b206dcd72192e6126f937a9dc85afe1a05730a9a27b
SSDEEP

1536:MhBRVgrExucMgbM8t1/9/pjLlBninvbmViu:cRRsgM8t1V/pjLbivbmF

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2356-0-0x0000000010000000-0x0000000010017000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2356	1940	rundll32.exe	30
PID 1940 wrote to memory of 2356	1940	rundll32.exe	30
PID 1940 wrote to memory of 2356	1940	rundll32.exe	30
PID 1940 wrote to memory of 2356	1940	rundll32.exe	30
PID 1940 wrote to memory of 2356	1940	rundll32.exe	30
PID 1940 wrote to memory of 2356	1940	rundll32.exe	30
PID 1940 wrote to memory of 2356	1940	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40a9200d7f60be24934c1ee42fd97aa1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40a9200d7f60be24934c1ee42fd97aa1_JaffaCakes118.dll,#1
  2⤵
  PID:2356

memory/2356-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download