421e1f86cff117373289296d95c9a140e33115837fa4f5020cdcf52947e8e235

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 03:54 UTC

Target

481c887246ef56159dbf340a00170f12_JaffaCakes118.dll
Size

97KB
MD5

481c887246ef56159dbf340a00170f12
SHA1

e8d07efffa83c8957813f67d704ec904e1367e39
SHA256

421e1f86cff117373289296d95c9a140e33115837fa4f5020cdcf52947e8e235
SHA512

e16f3c69e7bb272ac8e7a6f65874aef3c871bc0e714920bc951123a4ca95863f1b2eba3883c8cac3a0f09e31a1a33a6951960394c56df7bd364b146ea8b45db3
SSDEEP

1536:ISKyVLql4k6MEymJKz9O/Vuq6913hrxJRk1sEX25ulG9IX:ISKyVLqikzEyh+SNRaX2sG9i

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2992-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2992	2316	rundll32.exe	30
PID 2316 wrote to memory of 2992	2316	rundll32.exe	30
PID 2316 wrote to memory of 2992	2316	rundll32.exe	30
PID 2316 wrote to memory of 2992	2316	rundll32.exe	30
PID 2316 wrote to memory of 2992	2316	rundll32.exe	30
PID 2316 wrote to memory of 2992	2316	rundll32.exe	30
PID 2316 wrote to memory of 2992	2316	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\481c887246ef56159dbf340a00170f12_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\481c887246ef56159dbf340a00170f12_JaffaCakes118.dll,#1
  2⤵
  PID:2992

memory/2992-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download