56bd4269046cd634d3bf413e927722344339e0823340c99cf49e068baad98b4b

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 21:38

Target

617f674f9af77e87fe03584dd6e4c6dd_JaffaCakes118.dll
Size

75KB
MD5

617f674f9af77e87fe03584dd6e4c6dd
SHA1

cc8e8b8d7db3a3ae67aa5cf3447936589ef41740
SHA256

56bd4269046cd634d3bf413e927722344339e0823340c99cf49e068baad98b4b
SHA512

3d30e221af15640899ab94e15731d9fd0bc2293ffac5240b7d273530d077336256faee5d412131e1b12520b8df67efe5f95b420941aef3bec373bcc9fe2a7a1b
SSDEEP

1536:jZIcCxRT2VakXUx86ltTOaZtTppoqlv+DFg:x+9XlDlpXZHpooMFg

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2820-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2820	2364	rundll32.exe	30
PID 2364 wrote to memory of 2820	2364	rundll32.exe	30
PID 2364 wrote to memory of 2820	2364	rundll32.exe	30
PID 2364 wrote to memory of 2820	2364	rundll32.exe	30
PID 2364 wrote to memory of 2820	2364	rundll32.exe	30
PID 2364 wrote to memory of 2820	2364	rundll32.exe	30
PID 2364 wrote to memory of 2820	2364	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\617f674f9af77e87fe03584dd6e4c6dd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\617f674f9af77e87fe03584dd6e4c6dd_JaffaCakes118.dll,#1
  2⤵
  PID:2820

memory/2820-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download