61a70c32ca137bf4f2f8199cbee5603b5764568719d66efcc90c44e3111a8458

Analysis

max time kernel
147s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-04-2024 18:25

Target

e81ef90f25128b07c4bd324c2dfcc8a4_JaffaCakes118.dll
Size

71KB
MD5

e81ef90f25128b07c4bd324c2dfcc8a4
SHA1

9a8eb6978e4144392e2cedf8138a99beae56960a
SHA256

61a70c32ca137bf4f2f8199cbee5603b5764568719d66efcc90c44e3111a8458
SHA512

d9ba4a06ea4ffdbcfb12b9ed05d61c32d599d66e2f50e785f5e53f11277e2b15abc800624c126fbcecd9db047ff486e54f75dad9f8028bc520c51a149bf37932
SSDEEP

1536:MhBRVgrExucM1bX7cclWgBPrMCZS6ADZEuy:cRRs7/ogB5S6Ac

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4492-0-0x0000000010000000-0x0000000010017000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 4492	3724	rundll32.exe	85
PID 3724 wrote to memory of 4492	3724	rundll32.exe	85
PID 3724 wrote to memory of 4492	3724	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e81ef90f25128b07c4bd324c2dfcc8a4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e81ef90f25128b07c4bd324c2dfcc8a4_JaffaCakes118.dll,#1
  2⤵
  PID:4492

memory/4492-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download