4da4d3c3e081cac61dfb6d26cc2737924025cd77a88df58c45548d998bfbb611

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 19:22

Target

4302f6c7e515930f2928399d208b1617_JaffaCakes118.dll
Size

34KB
MD5

4302f6c7e515930f2928399d208b1617
SHA1

cf35c02037e7133fbafb845f3c9db64d80451d14
SHA256

4da4d3c3e081cac61dfb6d26cc2737924025cd77a88df58c45548d998bfbb611
SHA512

95f036aa16728fe13ebdb10913e44b232b6338486988da8398a2dc94ac526116bba3acb16195ea22706c79e3747cd3c78e6b8d8e9550d97a39f48859bd32c3e6
SSDEEP

768:56IRmOOuKDowVUuxzp07IYhqkiTxvXXler4NVK:5jRmO9MU8zp93XVhVK

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2396-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 2396	1000	rundll32.exe	31
PID 1000 wrote to memory of 2396	1000	rundll32.exe	31
PID 1000 wrote to memory of 2396	1000	rundll32.exe	31
PID 1000 wrote to memory of 2396	1000	rundll32.exe	31
PID 1000 wrote to memory of 2396	1000	rundll32.exe	31
PID 1000 wrote to memory of 2396	1000	rundll32.exe	31
PID 1000 wrote to memory of 2396	1000	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4302f6c7e515930f2928399d208b1617_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4302f6c7e515930f2928399d208b1617_JaffaCakes118.dll,#1
  2⤵
  PID:2396

memory/2396-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download