68e754b0206af36483c5d44a7eeca8f61d5586eaf5426ea1f933fbfe4c5652e0

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 11:23

Target

4e17d78888219edbd94414b8f8b809c0_JaffaCakes118.dll
Size

66KB
MD5

4e17d78888219edbd94414b8f8b809c0
SHA1

75e0dbdc0f21fbd234b6a2786c027648074b4472
SHA256

68e754b0206af36483c5d44a7eeca8f61d5586eaf5426ea1f933fbfe4c5652e0
SHA512

1c75979265ff4191b2e9dbec70d7ea80d90a1ae018fdf40497bf0e54398668d56fb4663fcaf506a9acb60c18be03a170a45f1ec331384d64a60f541abd09fb54
SSDEEP

1536:Bdu6F2229vCXG2sHzYLApkWQ7nX/4bIoFFIvvGTnchVtb:XE9vxI7Xw6vOT8bb

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2852-0-0x0000000010000000-0x0000000010042000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2852	2624	rundll32.exe	30
PID 2624 wrote to memory of 2852	2624	rundll32.exe	30
PID 2624 wrote to memory of 2852	2624	rundll32.exe	30
PID 2624 wrote to memory of 2852	2624	rundll32.exe	30
PID 2624 wrote to memory of 2852	2624	rundll32.exe	30
PID 2624 wrote to memory of 2852	2624	rundll32.exe	30
PID 2624 wrote to memory of 2852	2624	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e17d78888219edbd94414b8f8b809c0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e17d78888219edbd94414b8f8b809c0_JaffaCakes118.dll,#1
  2⤵
  PID:2852

memory/2852-0-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download