40b8beef399d361981dfa511f743485d5e70d8c0def33edc6ee33084b794264c

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 09:17

Target

492b03d2daa7d0e92116ff84d12ebee9_JaffaCakes118.dll
Size

5KB
MD5

492b03d2daa7d0e92116ff84d12ebee9
SHA1

79f80d805c57417320ccdeec9797a0d88a04c598
SHA256

40b8beef399d361981dfa511f743485d5e70d8c0def33edc6ee33084b794264c
SHA512

8e803b3b7c67e1aa2da304759f7f680b6d0d6acebc31f51f4a0878f335db117c5f3abf2b4b803d6ced8b28d15466db0fdcc8472cee2ceaa2fe08b509a62e5510
SSDEEP

96:jCd7+HQG7I+g+tgRDgfih8ONTnB3zm6QQQIIIZxgxI9:jU7/G75go0jh8ONFzmxQQET

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2692-0-0x0000000010000000-0x000000001000B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 2692	2572	rundll32.exe	30
PID 2572 wrote to memory of 2692	2572	rundll32.exe	30
PID 2572 wrote to memory of 2692	2572	rundll32.exe	30
PID 2572 wrote to memory of 2692	2572	rundll32.exe	30
PID 2572 wrote to memory of 2692	2572	rundll32.exe	30
PID 2572 wrote to memory of 2692	2572	rundll32.exe	30
PID 2572 wrote to memory of 2692	2572	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\492b03d2daa7d0e92116ff84d12ebee9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\492b03d2daa7d0e92116ff84d12ebee9_JaffaCakes118.dll,#1
  2⤵
  PID:2692

memory/2692-0-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download