afd06340f17c65ad82e3eaca6d63f43e2fce2d04d6ea8187eadb2a1d740e32af

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 12:46

Target

5c0050262342e69739875b0b812fdcd7_JaffaCakes118.dll
Size

51KB
MD5

5c0050262342e69739875b0b812fdcd7
SHA1

752cb660b6cb9e0225151b1ab239c89dc777a1fb
SHA256

afd06340f17c65ad82e3eaca6d63f43e2fce2d04d6ea8187eadb2a1d740e32af
SHA512

c2adfb51df50a60ae5bf9b1a1301ec8b3462fd0c0abc41ff4e7f44eddda1e99669c15ebea14b5fd45006661cc989d0583d41df52fbd82845df3790dfbfb08833
SSDEEP

768:yuUr3ip/IHI7NQTvKS97UqGan+/1p3cK3sLMpEIUOMv9nYtRwg8O7ykN:yl3E0TiSueKvoLMUxcRw07P

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2184-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2184	2448	rundll32.exe	30
PID 2448 wrote to memory of 2184	2448	rundll32.exe	30
PID 2448 wrote to memory of 2184	2448	rundll32.exe	30
PID 2448 wrote to memory of 2184	2448	rundll32.exe	30
PID 2448 wrote to memory of 2184	2448	rundll32.exe	30
PID 2448 wrote to memory of 2184	2448	rundll32.exe	30
PID 2448 wrote to memory of 2184	2448	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c0050262342e69739875b0b812fdcd7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c0050262342e69739875b0b812fdcd7_JaffaCakes118.dll,#1
  2⤵
  PID:2184

memory/2184-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download