dc41df30f62380e190c7665512bc47897495a70c871ad599bfcca763c78f940e

Analysis

max time kernel
89s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 12:21

Target

e9fa20c10d46b685256fe46cdbda242b_JaffaCakes118.dll
Size

60KB
MD5

e9fa20c10d46b685256fe46cdbda242b
SHA1

efd89f65d70016dce256e6f06272c25403e51587
SHA256

dc41df30f62380e190c7665512bc47897495a70c871ad599bfcca763c78f940e
SHA512

65e0ad4b761c37c69248bb69d56cb8a3f4f0ddde3c99ef7b3fc04e255d1a5876436d8df3efdd9fbc123c6dbb1b39dfa023028f2e4bd10506b4e5e01e86d57fab
SSDEEP

768:ZujfnoaiGDwbzgduJqSaDBgPD197deIoQ6VFzGrw9EtaVVWZCzZ2qwP5W3IKOUPq:MjfoaNd9ObxeIIVFzGrWEtQ7ZruSP/Hy

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3420-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 3420	2428	rundll32.exe	87
PID 2428 wrote to memory of 3420	2428	rundll32.exe	87
PID 2428 wrote to memory of 3420	2428	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9fa20c10d46b685256fe46cdbda242b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9fa20c10d46b685256fe46cdbda242b_JaffaCakes118.dll,#1
  2⤵
  PID:3420

memory/3420-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download