aed7dfea83b1780e584b267c5c6c6212b8005ec5a3170b6526e29f5620d2e3b1

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 11:06

Target

67550c4f6c0e7a8ef4dff6759406ab19_JaffaCakes118.dll
Size

67KB
MD5

67550c4f6c0e7a8ef4dff6759406ab19
SHA1

9b94375055ee3f0682da715dfb578a7944b50384
SHA256

aed7dfea83b1780e584b267c5c6c6212b8005ec5a3170b6526e29f5620d2e3b1
SHA512

f31f45f4bafc9b4042647489baa57ba6e25ec13eb148c22e3975f149255beb38c40107efdcbe526f02937c73559e171df7650717a77057e54df123704f2d1f41
SSDEEP

1536:rlxKpFLLZLJk8IqLJXfJhiTlGhTUyB9W6QfdvV:30tJDRhPhTUew6QfdvV

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2768-0-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2768	2772	rundll32.exe	30
PID 2772 wrote to memory of 2768	2772	rundll32.exe	30
PID 2772 wrote to memory of 2768	2772	rundll32.exe	30
PID 2772 wrote to memory of 2768	2772	rundll32.exe	30
PID 2772 wrote to memory of 2768	2772	rundll32.exe	30
PID 2772 wrote to memory of 2768	2772	rundll32.exe	30
PID 2772 wrote to memory of 2768	2772	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67550c4f6c0e7a8ef4dff6759406ab19_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\67550c4f6c0e7a8ef4dff6759406ab19_JaffaCakes118.dll,#1
  2⤵
  PID:2768

memory/2768-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download