cdb6377b6c498f4bd8962a20573d66c08ef3137fc83923f09440b3a619cc7db2 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 20:08

Sharing

Report Analysis Logs

General

Target

649f64b0dbf2229b8ee7ac340bc52bc0_JaffaCakes118.dll
Size

63KB
MD5

649f64b0dbf2229b8ee7ac340bc52bc0
SHA1

084759108e67f297974fa8d15a96b8370d3cc84e
SHA256

cdb6377b6c498f4bd8962a20573d66c08ef3137fc83923f09440b3a619cc7db2
SHA512

877c26c0d5fb444b81d8999ff3ac81f0bc51fcc1e8e8e6f22982edf64f9d9f7a3a0e56366b73169fa6d28b3fc91ab6d51b356c9f6078755b7f71c9ec4e92872b
SSDEEP

1536:agF0eiyUcb8SUbNAO1jSBXTY46Aq994/FAH:t2yFbjr6T9mFq

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1688-0-0x0000000010000000-0x0000000010011000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 1688	1828	rundll32.exe	30
PID 1828 wrote to memory of 1688	1828	rundll32.exe	30
PID 1828 wrote to memory of 1688	1828	rundll32.exe	30
PID 1828 wrote to memory of 1688	1828	rundll32.exe	30
PID 1828 wrote to memory of 1688	1828	rundll32.exe	30
PID 1828 wrote to memory of 1688	1828	rundll32.exe	30
PID 1828 wrote to memory of 1688	1828	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\649f64b0dbf2229b8ee7ac340bc52bc0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\649f64b0dbf2229b8ee7ac340bc52bc0_JaffaCakes118.dll,#1
  2⤵
  PID:1688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1688-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download