83503e9b7b4c9b857f68d40ddfdd961aeec169acc0ade07e0ff721a814c90317

Analysis

max time kernel
15s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 15:20

Target

63b5c1dea1354149c77e58344dce4eb8_JaffaCakes118.dll
Size

68KB
MD5

63b5c1dea1354149c77e58344dce4eb8
SHA1

9646d363939bf81ef82e31492acb7414d12d2806
SHA256

83503e9b7b4c9b857f68d40ddfdd961aeec169acc0ade07e0ff721a814c90317
SHA512

57b1dda4fda5504ac1c07e90a763a5edcf944957f43ae9c9e5e2993f8aec5ac478dbeefa17718a8699eed3334febeb82d6aa769903ef6d9927e8120bb81be7f6
SSDEEP

1536:caT4tmNjgtApE5YiaVrD374Y8zc+p4EA6ju:mcjgGM25oY8zc+HA6ju

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2348-1-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2348	2300	rundll32.exe	29
PID 2300 wrote to memory of 2348	2300	rundll32.exe	29
PID 2300 wrote to memory of 2348	2300	rundll32.exe	29
PID 2300 wrote to memory of 2348	2300	rundll32.exe	29
PID 2300 wrote to memory of 2348	2300	rundll32.exe	29
PID 2300 wrote to memory of 2348	2300	rundll32.exe	29
PID 2300 wrote to memory of 2348	2300	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\63b5c1dea1354149c77e58344dce4eb8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\63b5c1dea1354149c77e58344dce4eb8_JaffaCakes118.dll,#1
  2⤵
  PID:2348

memory/2348-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2348-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download