5d4ade9c226dc3aeabf59581813e01884940af5c1463eb14c6fcc168aea14056

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 21:00

Target

e86830afbd823e15d1699558083ef39b_JaffaCakes118.dll
Size

98KB
MD5

e86830afbd823e15d1699558083ef39b
SHA1

4e60216eb2254ba660c47dcf386295d454ee1eda
SHA256

5d4ade9c226dc3aeabf59581813e01884940af5c1463eb14c6fcc168aea14056
SHA512

b0da0be40ea46ee0ef05d7948dd3ac109752d552e0632731f5dce28e718500db327b90049eba63ddf9b378247cbc2ca06b69e64b5a4938635099d88e997bf9dd
SSDEEP

1536:QPHd2owFn+G5mAGHnWaulatYjmuDyX6B95o4K0oOitxgLR18n2Gf0HAO5d2Apr:QP9hwdmPnWIWjm4yoLo//txgV182OOl

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1436-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1436	1100	rundll32.exe	85
PID 1100 wrote to memory of 1436	1100	rundll32.exe	85
PID 1100 wrote to memory of 1436	1100	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e86830afbd823e15d1699558083ef39b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e86830afbd823e15d1699558083ef39b_JaffaCakes118.dll,#1
  2⤵
  PID:1436

memory/1436-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download