03da474de11f3f98c0a4ddbed5dc588b76973c6708ca1f0fadee44a6f72d321a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 00:34

Target

4c1423eddc919affb86bd67b43a42462_JaffaCakes118.dll
Size

130KB
MD5

4c1423eddc919affb86bd67b43a42462
SHA1

4bf5a6ef5a285a80f3f963ef9cf052c812865850
SHA256

03da474de11f3f98c0a4ddbed5dc588b76973c6708ca1f0fadee44a6f72d321a
SHA512

8698810fd1b486b41e2a7e0a2aa9c1937132d88d3c45e07e62f11baf1d11337985a473ee576f214289b0fff5f9c0f712bb9abb2b85ee4863e8cdc35272058855
SSDEEP

1536:Y2ZAh9wJua1ZRIbI+e2BrMg8LiyKTGmFX7tb2P5OxMLBXpJjBhScMzW:tIwYNU3LipGeX7tkPLbJniC

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2664-0-0x00000000001E0000-0x00000000001ED000-memory.dmp	upx
behavioral1/memory/2664-4-0x00000000001E0000-0x00000000001ED000-memory.dmp	upx
behavioral1/memory/2664-3-0x00000000001E0000-0x00000000001ED000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2664	824	rundll32.exe	31
PID 824 wrote to memory of 2664	824	rundll32.exe	31
PID 824 wrote to memory of 2664	824	rundll32.exe	31
PID 824 wrote to memory of 2664	824	rundll32.exe	31
PID 824 wrote to memory of 2664	824	rundll32.exe	31
PID 824 wrote to memory of 2664	824	rundll32.exe	31
PID 824 wrote to memory of 2664	824	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c1423eddc919affb86bd67b43a42462_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c1423eddc919affb86bd67b43a42462_JaffaCakes118.dll,#1
  2⤵
  PID:2664

memory/2664-0-0x00000000001E0000-0x00000000001ED000-memory.dmp

Filesize
52KB

Download
memory/2664-4-0x00000000001E0000-0x00000000001ED000-memory.dmp

Filesize
52KB

Download
memory/2664-3-0x00000000001E0000-0x00000000001ED000-memory.dmp

Filesize
52KB

Download
memory/2664-5-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2664-6-0x00000000001E7000-0x00000000001EC000-memory.dmp

Filesize
20KB

Download
memory/2664-7-0x00000000001E1000-0x00000000001E7000-memory.dmp

Filesize
24KB

Download