5819c0cc626ad2abb4fb13e17661a8889fbcb03cbfc0f2a1169ce40fd9c9419a

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 03:16

Target

4c95f8320f48d9e54911e3721d35a5dc_JaffaCakes118.dll
Size

90KB
MD5

4c95f8320f48d9e54911e3721d35a5dc
SHA1

c435661b48c9f667d2d2414cddbff565b309772c
SHA256

5819c0cc626ad2abb4fb13e17661a8889fbcb03cbfc0f2a1169ce40fd9c9419a
SHA512

b6f84993992e24a5f86202ac8547720e4fbddc7728643af4e5a92fac6e74e8a8c000aca8ce8ecc8190d5b3168e7a5bf40e1b9290fca99b2c7bfb95dc80f441ee
SSDEEP

1536:JVGqeHHrjdj9qccps9uRakievn+oC4vBg286lh:JKLjdjAccpsVHevn+F8g2xL

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1344-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1344	1048	rundll32.exe	29
PID 1048 wrote to memory of 1344	1048	rundll32.exe	29
PID 1048 wrote to memory of 1344	1048	rundll32.exe	29
PID 1048 wrote to memory of 1344	1048	rundll32.exe	29
PID 1048 wrote to memory of 1344	1048	rundll32.exe	29
PID 1048 wrote to memory of 1344	1048	rundll32.exe	29
PID 1048 wrote to memory of 1344	1048	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c95f8320f48d9e54911e3721d35a5dc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c95f8320f48d9e54911e3721d35a5dc_JaffaCakes118.dll,#1
  2⤵
  PID:1344

memory/1344-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download