6cd824c442922f9e41641909b7869fb942237aecd6fb74d91e3582f7e4b08c3d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 05:46

Target

448d3cf157dae46eb93b79248b29b23d_JaffaCakes118.dll
Size

42KB
MD5

448d3cf157dae46eb93b79248b29b23d
SHA1

89cb43626d3505403ad5933f9d109300ae2d83fa
SHA256

6cd824c442922f9e41641909b7869fb942237aecd6fb74d91e3582f7e4b08c3d
SHA512

a3b18fd524218029e4861eae842341868ea7bca3f05d3b9419c59b12d8314705fb94edb37699264c7ad2c9392b4ec6b0f9cb393e6b6de7a36ba0d88d1bda0cb0
SSDEEP

384:2+Vbx8p9MPSg2TqE0tJQ8OAYBrJrAS3snFXiQuJi46/okJMyW6YWNJJFQ:2ebxBPWqE0t1J6Ffc6FMZ6kJ

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2776-3-0x0000000010000000-0x000000001000C000-memory.dmp	upx
behavioral1/memory/2776-2-0x0000000010000000-0x000000001000C000-memory.dmp	upx
behavioral1/memory/2776-1-0x0000000010000000-0x000000001000C000-memory.dmp	upx
behavioral1/memory/2776-0-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2776	2348	rundll32.exe	30
PID 2348 wrote to memory of 2776	2348	rundll32.exe	30
PID 2348 wrote to memory of 2776	2348	rundll32.exe	30
PID 2348 wrote to memory of 2776	2348	rundll32.exe	30
PID 2348 wrote to memory of 2776	2348	rundll32.exe	30
PID 2348 wrote to memory of 2776	2348	rundll32.exe	30
PID 2348 wrote to memory of 2776	2348	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\448d3cf157dae46eb93b79248b29b23d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\448d3cf157dae46eb93b79248b29b23d_JaffaCakes118.dll,#1
  2⤵
  PID:2776

memory/2776-3-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2776-2-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2776-1-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2776-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download