413db5dfbe9da7e10b36de4e79b92dc8d9836fb079119983efaea8a42f0749f9

Analysis

max time kernel
141s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 21:01

Target

6161b98febb83a71509ef4ae8da8e040_JaffaCakes118.dll
Size

11KB
MD5

6161b98febb83a71509ef4ae8da8e040
SHA1

7b6d9e27798859ea0bd6fb821123348691f6cd51
SHA256

413db5dfbe9da7e10b36de4e79b92dc8d9836fb079119983efaea8a42f0749f9
SHA512

d3ab019df8c3129df2bdef203727a9f26c1fe06dee96d1ffcb9e6083bf35d121c913ab958c689e66bb4e3575a9ac8632779bccc75448c0f6821df00be1d3fe94
SSDEEP

192:g+vyB2KjCWUruveAODIFw1GP1s7xRyWPs9R1d94/s82NT3GgJr1:gtbCweA1w1e4jsd6x2R3Gg/

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2564-0-0x0000000010000000-0x000000001000A000-memory.dmp	upx
behavioral1/memory/2564-1-0x0000000010000000-0x000000001000A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2564	2172	rundll32.exe	29
PID 2172 wrote to memory of 2564	2172	rundll32.exe	29
PID 2172 wrote to memory of 2564	2172	rundll32.exe	29
PID 2172 wrote to memory of 2564	2172	rundll32.exe	29
PID 2172 wrote to memory of 2564	2172	rundll32.exe	29
PID 2172 wrote to memory of 2564	2172	rundll32.exe	29
PID 2172 wrote to memory of 2564	2172	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6161b98febb83a71509ef4ae8da8e040_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6161b98febb83a71509ef4ae8da8e040_JaffaCakes118.dll,#1
  2⤵
  PID:2564

memory/2564-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/2564-1-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download