f9c40b137e144e5caf0fa85aa7802895399c7be25bc414111a3de90a4f40283d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 03:04

Target

5ecac717d9e4f7b79e050d8747b9bc35_JaffaCakes118.dll
Size

75KB
MD5

5ecac717d9e4f7b79e050d8747b9bc35
SHA1

a95457b2d8a42ae727d93c9b98f26e3cb5b5cdac
SHA256

f9c40b137e144e5caf0fa85aa7802895399c7be25bc414111a3de90a4f40283d
SHA512

97fd5b4c2858de484170cef0a953d3c5effbc010063535785eb4a5fbeaf51438e6b07b52f4e4b43a022e124c642ca8e29998580e12c6b469ed47bbb6389bd1f9
SSDEEP

768:FI//LaClGk0Un6sy/7B/lB4swK40t0bDYclEuAPOxtDmni/2WrKWU53W+Vqv6aGj:uLagGKilBnQ0qS8tDEi/Bi3W+Vw625e7

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1356-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 1356	2680	rundll32.exe	30
PID 2680 wrote to memory of 1356	2680	rundll32.exe	30
PID 2680 wrote to memory of 1356	2680	rundll32.exe	30
PID 2680 wrote to memory of 1356	2680	rundll32.exe	30
PID 2680 wrote to memory of 1356	2680	rundll32.exe	30
PID 2680 wrote to memory of 1356	2680	rundll32.exe	30
PID 2680 wrote to memory of 1356	2680	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ecac717d9e4f7b79e050d8747b9bc35_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ecac717d9e4f7b79e050d8747b9bc35_JaffaCakes118.dll,#1
  2⤵
  PID:1356

memory/1356-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download