f1253c4b3159e1c6ccae67c8a0d13f6ada8955b4e8ba449cda909d42bd9de3ff

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 16:14

Target

4690eeca1d9c964580985c85c3908a15_JaffaCakes118.dll
Size

61KB
MD5

4690eeca1d9c964580985c85c3908a15
SHA1

828604354511a6c9511cb97405e19223b5583076
SHA256

f1253c4b3159e1c6ccae67c8a0d13f6ada8955b4e8ba449cda909d42bd9de3ff
SHA512

ed0eef5df6138d7955784f9c36bec3a9f83fb731915c19cf6cf4a783c164da23e965c69c2ca4ab3490c88cb8cb11f23b2624bb89c0766c950fb7e9c9355541f9
SSDEEP

1536:OzN56+Ijs8hGUwOmOu+TWI/ZyNc5TBsgDMp+R:OzO+IZjuWR3TrMpA

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2760-0-0x0000000010000000-0x000000001096E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2760	1628	rundll32.exe	30
PID 1628 wrote to memory of 2760	1628	rundll32.exe	30
PID 1628 wrote to memory of 2760	1628	rundll32.exe	30
PID 1628 wrote to memory of 2760	1628	rundll32.exe	30
PID 1628 wrote to memory of 2760	1628	rundll32.exe	30
PID 1628 wrote to memory of 2760	1628	rundll32.exe	30
PID 1628 wrote to memory of 2760	1628	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4690eeca1d9c964580985c85c3908a15_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4690eeca1d9c964580985c85c3908a15_JaffaCakes118.dll,#1
  2⤵
  PID:2760

memory/2760-0-0x0000000010000000-0x000000001096E000-memory.dmp

Filesize
9.4MB

Download