70f425fb29560e17bf7c3e85bed761a740fdf551ff45051a9523d7ce00c1ee09

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 10:37

Target

62e5547dd7b13ae0897c3aa893c939ef_JaffaCakes118.dll
Size

30KB
MD5

62e5547dd7b13ae0897c3aa893c939ef
SHA1

54d77b0a36595f3636908f59ec8df5bbe8113489
SHA256

70f425fb29560e17bf7c3e85bed761a740fdf551ff45051a9523d7ce00c1ee09
SHA512

40560be781570fb5497ca1046c88cdd7168c915aac96b9c8ebed9fd362529ee370b443dc1230009913358a8a7b06b6c03bb9f6c048e8ba14b0f26319f99ca595
SSDEEP

384:4xe0cibsqIv8434FSEa5ScQtv7KgEfvk2Vulagr1RR+NNUaJaR6x9OqraNqZg:4xejyIv843MV8QFCMzhRcjJa89OEaa

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2404-3-0x0000000000130000-0x0000000000150000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2404	2924	rundll32.exe	31
PID 2924 wrote to memory of 2404	2924	rundll32.exe	31
PID 2924 wrote to memory of 2404	2924	rundll32.exe	31
PID 2924 wrote to memory of 2404	2924	rundll32.exe	31
PID 2924 wrote to memory of 2404	2924	rundll32.exe	31
PID 2924 wrote to memory of 2404	2924	rundll32.exe	31
PID 2924 wrote to memory of 2404	2924	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\62e5547dd7b13ae0897c3aa893c939ef_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\62e5547dd7b13ae0897c3aa893c939ef_JaffaCakes118.dll,#1
  2⤵
  PID:2404

memory/2404-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2404-2-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2404-1-0x0000000010013000-0x0000000010014000-memory.dmp

Filesize
4KB

Download
memory/2404-4-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2404-3-0x0000000000130000-0x0000000000150000-memory.dmp

Filesize
128KB

Download
memory/2404-5-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download