14fec2399cb3a8541dcbc2a0260379e9fe978addcab51062f2eec04ee66b9922

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 22:55

Target

61be81e5fec982c536a8003bc3be3895_JaffaCakes118.dll
Size

65KB
MD5

61be81e5fec982c536a8003bc3be3895
SHA1

69424ca9cce92300c9e9c74e00f374bf8973aaed
SHA256

14fec2399cb3a8541dcbc2a0260379e9fe978addcab51062f2eec04ee66b9922
SHA512

7b506651c420a2abe721651431ac42c5870c60f169c970e941134b93ae9301ca3f8263a41fa76b8b3d2f3891948df4bcbf58ce6945ea04e897d2dc091ac0fd9c
SSDEEP

1536:1zExMwCGQ2jyBaeZL22hzXeq6Zg4eNCaAquSjHlXuw65:1I+wCGv6aeZLvhjJUg4YCwuShew65

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/300-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 300	2368	rundll32.exe	31
PID 2368 wrote to memory of 300	2368	rundll32.exe	31
PID 2368 wrote to memory of 300	2368	rundll32.exe	31
PID 2368 wrote to memory of 300	2368	rundll32.exe	31
PID 2368 wrote to memory of 300	2368	rundll32.exe	31
PID 2368 wrote to memory of 300	2368	rundll32.exe	31
PID 2368 wrote to memory of 300	2368	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61be81e5fec982c536a8003bc3be3895_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\61be81e5fec982c536a8003bc3be3895_JaffaCakes118.dll,#1
  2⤵
  PID:300

memory/300-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/300-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download