fbda5e3fcfb12c0db2fb93d626fc26cf36e0389abff5917a85f8aaf12dc124cd

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 21:20

Target

617169928ff728ec92aafd0c2a6a43b5_JaffaCakes118.dll
Size

53KB
MD5

617169928ff728ec92aafd0c2a6a43b5
SHA1

5963c85aaee58d461a7d408e503796bcb80df733
SHA256

fbda5e3fcfb12c0db2fb93d626fc26cf36e0389abff5917a85f8aaf12dc124cd
SHA512

ad8a335952c749b1291d19070c18f3dc176dac16d96c4959378a0b905768044994b0faa1a52937c633ec57f616f0aa1cc7ebcafe6f5e571f6dcf9d3d361acdc0
SSDEEP

768:SIa/yUwPx7zfArDMbW+MjELBNqzRRLMtmsRVXr924mKyppeHK9GWKDPunK:SNCUGhMg62rhMrAmGtDP6K

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2972-0-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2972-3-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2972-2-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2972-1-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2972	2348	rundll32.exe	29
PID 2348 wrote to memory of 2972	2348	rundll32.exe	29
PID 2348 wrote to memory of 2972	2348	rundll32.exe	29
PID 2348 wrote to memory of 2972	2348	rundll32.exe	29
PID 2348 wrote to memory of 2972	2348	rundll32.exe	29
PID 2348 wrote to memory of 2972	2348	rundll32.exe	29
PID 2348 wrote to memory of 2972	2348	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\617169928ff728ec92aafd0c2a6a43b5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\617169928ff728ec92aafd0c2a6a43b5_JaffaCakes118.dll,#1
  2⤵
  PID:2972

memory/2972-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2972-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2972-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2972-1-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download