7ed244a0e0d31cc5da8335ede4c588c67b6870faa85e6800da18c3e1563ee800

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 14:06

Target

49ffb1aebce0bc0ba70965e9f213b488_JaffaCakes118.dll
Size

67KB
MD5

49ffb1aebce0bc0ba70965e9f213b488
SHA1

12d9fae5e35f12d57247b9403bb71461050e484d
SHA256

7ed244a0e0d31cc5da8335ede4c588c67b6870faa85e6800da18c3e1563ee800
SHA512

3820a4419587168df26b817f4792139569b7d06e26764e25c48d521d6a58dc1b401d7dd55765d2f21107047374ddc484cd4b689ebe06374fdda69933c5960f2a
SSDEEP

1536:mtiGSJcARcmBtW0AweUwDiu1OUR5FQ4HKt4QijDNc0IsdspAH:mt0cJmGweb71lRI4HKtji9cdsd4AH

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2980-0-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/2980-1-0x0000000010000000-0x0000000010043000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2980	1812	rundll32.exe	30
PID 1812 wrote to memory of 2980	1812	rundll32.exe	30
PID 1812 wrote to memory of 2980	1812	rundll32.exe	30
PID 1812 wrote to memory of 2980	1812	rundll32.exe	30
PID 1812 wrote to memory of 2980	1812	rundll32.exe	30
PID 1812 wrote to memory of 2980	1812	rundll32.exe	30
PID 1812 wrote to memory of 2980	1812	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\49ffb1aebce0bc0ba70965e9f213b488_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\49ffb1aebce0bc0ba70965e9f213b488_JaffaCakes118.dll,#1
  2⤵
  PID:2980

memory/2980-0-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/2980-1-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download