7ed55791e7dcade3477e3561d411dc500835ec6cbd390a8f04357931185aea1b

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 03:16

Target

44116f956c57af7b4bedf2492bb8af9b_JaffaCakes118.dll
Size

11KB
MD5

44116f956c57af7b4bedf2492bb8af9b
SHA1

578187d49b5433ef7f72021e3330c41e5e64a965
SHA256

7ed55791e7dcade3477e3561d411dc500835ec6cbd390a8f04357931185aea1b
SHA512

1c490d1a91871dcf4fa3e57b7106af72f5d17f5d3042cf8fa01e18117f784a53dbe89fd6b85532d2df44cbad5ac472004853fcdd3d644f85171a9fb8b1814902
SSDEEP

192:fqn51yDvVmBbxdVSr2beTn6qTojg5I8UHI7C0mbeKGBQeMgULUdMUYBc:2vyDgBFd6t3SyKreMgqB

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2644-0-0x0000000010000000-0x00000000100FF000-memory.dmp	upx
behavioral1/memory/2644-1-0x0000000010000000-0x00000000100FF000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2644	1960	rundll32.exe	30
PID 1960 wrote to memory of 2644	1960	rundll32.exe	30
PID 1960 wrote to memory of 2644	1960	rundll32.exe	30
PID 1960 wrote to memory of 2644	1960	rundll32.exe	30
PID 1960 wrote to memory of 2644	1960	rundll32.exe	30
PID 1960 wrote to memory of 2644	1960	rundll32.exe	30
PID 1960 wrote to memory of 2644	1960	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44116f956c57af7b4bedf2492bb8af9b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44116f956c57af7b4bedf2492bb8af9b_JaffaCakes118.dll,#1
  2⤵
  PID:2644

memory/2644-0-0x0000000010000000-0x00000000100FF000-memory.dmp

Filesize
1020KB

Download
memory/2644-1-0x0000000010000000-0x00000000100FF000-memory.dmp

Filesize
1020KB

Download