159a41b340d769a949d78c98a989d101fd262e0f6efbd71df4bab30171207da0

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 01:10

Target

59db2e9184e41582c7fb90544b91009a_JaffaCakes118.dll
Size

66KB
MD5

59db2e9184e41582c7fb90544b91009a
SHA1

0ec1b9ea3189383e2e7cf3185e76a8af367043df
SHA256

159a41b340d769a949d78c98a989d101fd262e0f6efbd71df4bab30171207da0
SHA512

23c83bddb4c880de452cf9e33dc1124d5869c70b20785b522d99beaa0c92b7c11470b31c1df774234c4a831e493ba54b5459c62c61ad0bc5cb9d8aa547c9d31a
SSDEEP

1536:DVV1HTV0b59r6zRrmTy44IICnFVCiNAyLrD/v72F+EpdEKE3uNf:DVrmT6QWIICCiNdb7dsdfE3uR

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2860-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2860	2700	rundll32.exe	30
PID 2700 wrote to memory of 2860	2700	rundll32.exe	30
PID 2700 wrote to memory of 2860	2700	rundll32.exe	30
PID 2700 wrote to memory of 2860	2700	rundll32.exe	30
PID 2700 wrote to memory of 2860	2700	rundll32.exe	30
PID 2700 wrote to memory of 2860	2700	rundll32.exe	30
PID 2700 wrote to memory of 2860	2700	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59db2e9184e41582c7fb90544b91009a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59db2e9184e41582c7fb90544b91009a_JaffaCakes118.dll,#1
  2⤵
  PID:2860

memory/2860-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download