20c1ee82af6d71d145383272e48ef22af15c00cf52d3eb23b794e5827eaef0af

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 01:57

Target

5a0307c37513334ee2e8e0a6910c5691_JaffaCakes118.dll
Size

59KB
MD5

5a0307c37513334ee2e8e0a6910c5691
SHA1

31b66ea8383a3e63dc4858ef1df446372a100437
SHA256

20c1ee82af6d71d145383272e48ef22af15c00cf52d3eb23b794e5827eaef0af
SHA512

d166de8cd67115beafbe8c09cca0f52b89afead6ecfb34b745f7ce91ee6ec1562e1d6a8885193d9a956ac6556b9b54bf2f9c134cc485fb5c7d86074501cdf1b1
SSDEEP

768:9xBtKtqyLU46hAvQYFMACDh4OZqMl+n3d3pk9OjDJdBZFwppr1BreZM3RllqAhTE:9KeAhMDIMoppk9O/dZmppRBreZMhzRI

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2520-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2520	2536	rundll32.exe	30
PID 2536 wrote to memory of 2520	2536	rundll32.exe	30
PID 2536 wrote to memory of 2520	2536	rundll32.exe	30
PID 2536 wrote to memory of 2520	2536	rundll32.exe	30
PID 2536 wrote to memory of 2520	2536	rundll32.exe	30
PID 2536 wrote to memory of 2520	2536	rundll32.exe	30
PID 2536 wrote to memory of 2520	2536	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a0307c37513334ee2e8e0a6910c5691_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a0307c37513334ee2e8e0a6910c5691_JaffaCakes118.dll,#1
  2⤵
  PID:2520

memory/2520-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download