7ae9ad420a31d885e42e05d9d41daf9d679ca71814fda5ea93be36fd235fb576

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 11:37

Target

6313cdc5353b002039f359ff9deda87c_JaffaCakes118.dll
Size

57KB
MD5

6313cdc5353b002039f359ff9deda87c
SHA1

a0b0360771c06ebf753a4119e6e41103acd45ae1
SHA256

7ae9ad420a31d885e42e05d9d41daf9d679ca71814fda5ea93be36fd235fb576
SHA512

a70cc31596d20a2555cdd7dfbd832fb67f8ea36e505d2872baf3a9245f3f8dd6e5cd85422c4c9c3b3f70247695b2a6573e6cd71e6989acb2269439a809f9c007
SSDEEP

1536:V8O9Nn6Rjri5q0yY3rJMYVURiwcv+Q3wOcs:2Oz6VWEY3rVaiwkss

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2348-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2348	1488	rundll32.exe	31
PID 1488 wrote to memory of 2348	1488	rundll32.exe	31
PID 1488 wrote to memory of 2348	1488	rundll32.exe	31
PID 1488 wrote to memory of 2348	1488	rundll32.exe	31
PID 1488 wrote to memory of 2348	1488	rundll32.exe	31
PID 1488 wrote to memory of 2348	1488	rundll32.exe	31
PID 1488 wrote to memory of 2348	1488	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6313cdc5353b002039f359ff9deda87c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6313cdc5353b002039f359ff9deda87c_JaffaCakes118.dll,#1
  2⤵
  PID:2348

memory/2348-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download