711d902dbcf18bb772b4e56edc9aaa637ce572b28cd088a649df73587b89054f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 02:54

Target

65dce671a77569d2db1a2f57e06ac347_JaffaCakes118.dll
Size

63KB
MD5

65dce671a77569d2db1a2f57e06ac347
SHA1

0d57afae188a8cd4547088c387f4e366450d7fc8
SHA256

711d902dbcf18bb772b4e56edc9aaa637ce572b28cd088a649df73587b89054f
SHA512

4538307b0c52d5ce1b4b396a3097971cd719060a215eb256c135530a1750f2756c0b7dd2565fe44ba023eeb415c792d8fcc2dc6f9fa9ac988e62fedbc1359280
SSDEEP

1536:NomNZnI+CQSrNF3NLe8L1pz3JCzxs29az6xV4l2kTeW:NooC+CpFpLP4AzkV4EkTeW

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1940-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1940	2544	rundll32.exe	30
PID 2544 wrote to memory of 1940	2544	rundll32.exe	30
PID 2544 wrote to memory of 1940	2544	rundll32.exe	30
PID 2544 wrote to memory of 1940	2544	rundll32.exe	30
PID 2544 wrote to memory of 1940	2544	rundll32.exe	30
PID 2544 wrote to memory of 1940	2544	rundll32.exe	30
PID 2544 wrote to memory of 1940	2544	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65dce671a77569d2db1a2f57e06ac347_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\65dce671a77569d2db1a2f57e06ac347_JaffaCakes118.dll,#1
  2⤵
  PID:1940

memory/1940-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download