654141c72be99afc54702725f5a09e3a442dd6a7982e6231e12ef3d1e6a3178b

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 20:02

Target

4b310682f9a72248788c96c0d9e610ff_JaffaCakes118.dll
Size

67KB
MD5

4b310682f9a72248788c96c0d9e610ff
SHA1

50581d3d2162929045329301e0e0dd5c71ec7a41
SHA256

654141c72be99afc54702725f5a09e3a442dd6a7982e6231e12ef3d1e6a3178b
SHA512

ac614fd021717cef6aafe06ac4ef3f33b37b10b9c32cf59c90f30d06f89932cbe515c48d2adb07a87c4f0acb27f868f254f0d9ee8d5412437df442de8be29df0
SSDEEP

768:td3p2uFBmzBlYVGnFNroEjBLuoZWukGyYSM+b32ifUvLUAW9cn6ot5:td3p/FBgBoGnMEdSoZWGC32ifWX6o3

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1736-0-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1736	rundll32.exe
1736	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 1736	2412	rundll32.exe	29
PID 2412 wrote to memory of 1736	2412	rundll32.exe	29
PID 2412 wrote to memory of 1736	2412	rundll32.exe	29
PID 2412 wrote to memory of 1736	2412	rundll32.exe	29
PID 2412 wrote to memory of 1736	2412	rundll32.exe	29
PID 2412 wrote to memory of 1736	2412	rundll32.exe	29
PID 2412 wrote to memory of 1736	2412	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b310682f9a72248788c96c0d9e610ff_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b310682f9a72248788c96c0d9e610ff_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1736

memory/1736-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download