Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    14/07/2024, 16:14

General

  • Target

    4690eeca1d9c964580985c85c3908a15_JaffaCakes118.dll

  • Size

    61KB

  • MD5

    4690eeca1d9c964580985c85c3908a15

  • SHA1

    828604354511a6c9511cb97405e19223b5583076

  • SHA256

    f1253c4b3159e1c6ccae67c8a0d13f6ada8955b4e8ba449cda909d42bd9de3ff

  • SHA512

    ed0eef5df6138d7955784f9c36bec3a9f83fb731915c19cf6cf4a783c164da23e965c69c2ca4ab3490c88cb8cb11f23b2624bb89c0766c950fb7e9c9355541f9

  • SSDEEP

    1536:OzN56+Ijs8hGUwOmOu+TWI/ZyNc5TBsgDMp+R:OzO+IZjuWR3TrMpA

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\4690eeca1d9c964580985c85c3908a15_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\4690eeca1d9c964580985c85c3908a15_JaffaCakes118.dll,#1
      2⤵
        PID:2760

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2760-0-0x0000000010000000-0x000000001096E000-memory.dmp

      Filesize

      9.4MB