8d382ac202617809f18aaf8629352c8f7962a315b2991d59be70e9c7be7c16e9

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 11:31

Target

45a08b33448eabf88d4027314d397d1b_JaffaCakes118.dll
Size

71KB
MD5

45a08b33448eabf88d4027314d397d1b
SHA1

ca7602c9477e93250ea8eebe6bbb97076ff25c22
SHA256

8d382ac202617809f18aaf8629352c8f7962a315b2991d59be70e9c7be7c16e9
SHA512

14175917f08effca794f56476f9971109c35b6f72bdb8e0dce80e1c37d1aad18e493f41ad4b61bea2c46110626bf8ceb2744674ac53454c07bc53d5a9df7c8e7
SSDEEP

1536:mPO6KEVbsVP0gYBx4qdhICL2EbWXVdAKC0ySipF1HoqnijMpvqro7SE28:cMEVbsVcXBaqjINEgAKCdp7IqniovgMl

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2836-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2836	2796	rundll32.exe	31
PID 2796 wrote to memory of 2836	2796	rundll32.exe	31
PID 2796 wrote to memory of 2836	2796	rundll32.exe	31
PID 2796 wrote to memory of 2836	2796	rundll32.exe	31
PID 2796 wrote to memory of 2836	2796	rundll32.exe	31
PID 2796 wrote to memory of 2836	2796	rundll32.exe	31
PID 2796 wrote to memory of 2836	2796	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45a08b33448eabf88d4027314d397d1b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\45a08b33448eabf88d4027314d397d1b_JaffaCakes118.dll,#1
  2⤵
  PID:2836

memory/2836-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download