45da9df23bfa0f6c46c9887d15771b522eb25de87461fd621d62845149598f47

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 08:55

Target

41040f75afbb237fc7e0815be78d3677_JaffaCakes118.dll
Size

91KB
MD5

41040f75afbb237fc7e0815be78d3677
SHA1

588ce99f2dac1b1a3f8b32c6791cf0bd035f9056
SHA256

45da9df23bfa0f6c46c9887d15771b522eb25de87461fd621d62845149598f47
SHA512

6bf1e8ba768ae0200be5351d86870f234bcd47ee5ff22214c7dfd0ab39be9c50eda036548830f2e6acef6f55bc1a2f35134988b0104aebd66d08056c01e9097e
SSDEEP

1536:MxvNbz0ZBTYCs6FJetuByWRn8xzsMn3xEcMkXyvLLW:OB0BTYCs6qRWRAzNCcMkiHW

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2204-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2204	2188	rundll32.exe	30
PID 2188 wrote to memory of 2204	2188	rundll32.exe	30
PID 2188 wrote to memory of 2204	2188	rundll32.exe	30
PID 2188 wrote to memory of 2204	2188	rundll32.exe	30
PID 2188 wrote to memory of 2204	2188	rundll32.exe	30
PID 2188 wrote to memory of 2204	2188	rundll32.exe	30
PID 2188 wrote to memory of 2204	2188	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41040f75afbb237fc7e0815be78d3677_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\41040f75afbb237fc7e0815be78d3677_JaffaCakes118.dll,#1
  2⤵
  PID:2204

memory/2204-2-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2204-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2204-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download