0783540ecc8bf0912984f2ce5d96602b4887fdca8f315a2299808a867c8483b2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 21:39

Target

4b83d5e20ea5f32255c9468623ef1159_JaffaCakes118.dll
Size

53KB
MD5

4b83d5e20ea5f32255c9468623ef1159
SHA1

9381b16821919ff8d1a6a6347f6735df989f98f5
SHA256

0783540ecc8bf0912984f2ce5d96602b4887fdca8f315a2299808a867c8483b2
SHA512

81e522747d1f04762fbd681ffa81f9c6be154ca1e6422cceb21d1585c21fa9ada008a3663068ea95f8f60fedf1253b69e380c1724b17b93945d0915f2c39af44
SSDEEP

1536:YJEu0nVKmxxRH9j1DT982duudl6mFC4yYEyuRjGa:YmJnVKidjP82lx04yYfuRjGa

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2312-1-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2312	2672	rundll32.exe	30
PID 2672 wrote to memory of 2312	2672	rundll32.exe	30
PID 2672 wrote to memory of 2312	2672	rundll32.exe	30
PID 2672 wrote to memory of 2312	2672	rundll32.exe	30
PID 2672 wrote to memory of 2312	2672	rundll32.exe	30
PID 2672 wrote to memory of 2312	2672	rundll32.exe	30
PID 2672 wrote to memory of 2312	2672	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b83d5e20ea5f32255c9468623ef1159_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b83d5e20ea5f32255c9468623ef1159_JaffaCakes118.dll,#1
  2⤵
  PID:2312

memory/2312-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2312-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download