21eb060ad8eeff74c273912715b8a8dbd60e3fe22810c657089b51e051ffee56

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 05:50

Target

665f00a9958824b642ae66cd148cd409_JaffaCakes118.dll
Size

105KB
MD5

665f00a9958824b642ae66cd148cd409
SHA1

5870830e1dec2aecbef4f11d35e36d6cb3b16afd
SHA256

21eb060ad8eeff74c273912715b8a8dbd60e3fe22810c657089b51e051ffee56
SHA512

5bae5910570c458aa5590244271bacced082d9d8c06d2e3917310ac94608ec12132254f7b1b99aa086a5f2c58736fa72388cb8b0c4209d1f4dcab231f581bbc0
SSDEEP

3072:LmFty1L8gDyOfrgWy5bowUKTUcC3mNdWoo:LUty1FyPpVdK2Ndxo

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2128-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2128	2204	rundll32.exe	30
PID 2204 wrote to memory of 2128	2204	rundll32.exe	30
PID 2204 wrote to memory of 2128	2204	rundll32.exe	30
PID 2204 wrote to memory of 2128	2204	rundll32.exe	30
PID 2204 wrote to memory of 2128	2204	rundll32.exe	30
PID 2204 wrote to memory of 2128	2204	rundll32.exe	30
PID 2204 wrote to memory of 2128	2204	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\665f00a9958824b642ae66cd148cd409_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\665f00a9958824b642ae66cd148cd409_JaffaCakes118.dll,#1
  2⤵
  PID:2128

memory/2128-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download