6f96a7d15243c07db657ec70461dbe7bfae3184e5e87aba88a81fe51ce6d932a

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 01:19

Target

6236a4c6c8f55891bf50d00b7eca4b36_JaffaCakes118.dll
Size

9KB
MD5

6236a4c6c8f55891bf50d00b7eca4b36
SHA1

fc02a2e917fc455c783987c4a6b3644831d511f3
SHA256

6f96a7d15243c07db657ec70461dbe7bfae3184e5e87aba88a81fe51ce6d932a
SHA512

a39f46e5fc2a6222580809e232121cf530f6972e6dff2bf0736164892ab24fd7000ac3d159014fe8b51fff8b75897a0dcca468d6c907477d94051aa5175f5b29
SSDEEP

96:2E5NOAXdhfop5zArGQwAXRbsnXWVb8Ivl08R85h/HMrASnF5QVjXIvN+FUKtOdaj:2D+Op5jrYb8IvlLR8jMPnwyMFbEkx

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2188-1-0x0000000010000000-0x000000001000D000-memory.dmp	upx
behavioral1/memory/2188-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2188	1628	rundll32.exe	30
PID 1628 wrote to memory of 2188	1628	rundll32.exe	30
PID 1628 wrote to memory of 2188	1628	rundll32.exe	30
PID 1628 wrote to memory of 2188	1628	rundll32.exe	30
PID 1628 wrote to memory of 2188	1628	rundll32.exe	30
PID 1628 wrote to memory of 2188	1628	rundll32.exe	30
PID 1628 wrote to memory of 2188	1628	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6236a4c6c8f55891bf50d00b7eca4b36_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6236a4c6c8f55891bf50d00b7eca4b36_JaffaCakes118.dll,#1
  2⤵
  PID:2188

memory/2188-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2188-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download