8e0998400987c78d74d782da3c03fd5f775a04da212c8c74d4f200632315f678

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 00:43

Target

6218a6a136e651dc2f298f3b2500233b_JaffaCakes118.dll
Size

63KB
MD5

6218a6a136e651dc2f298f3b2500233b
SHA1

1a519f96a889f645aceced487af601ee2cd13f9d
SHA256

8e0998400987c78d74d782da3c03fd5f775a04da212c8c74d4f200632315f678
SHA512

777b576b069588ae03356163b4a7523ef316beb5b559285a4d52f556cc2ebdb37b4e5a7259e496662ce60e62ceb21539f0261eef1a7dc8c2f9976742f21cbee7
SSDEEP

1536:mPO6KEVbsVP0gpWqb2B7FfEXxkBNwC3piCElh4XjngO:cMEVbsVc0zaB7hTBvpTkOUO

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2600-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2600	2212	rundll32.exe	30
PID 2212 wrote to memory of 2600	2212	rundll32.exe	30
PID 2212 wrote to memory of 2600	2212	rundll32.exe	30
PID 2212 wrote to memory of 2600	2212	rundll32.exe	30
PID 2212 wrote to memory of 2600	2212	rundll32.exe	30
PID 2212 wrote to memory of 2600	2212	rundll32.exe	30
PID 2212 wrote to memory of 2600	2212	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6218a6a136e651dc2f298f3b2500233b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6218a6a136e651dc2f298f3b2500233b_JaffaCakes118.dll,#1
  2⤵
  PID:2600

memory/2600-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download