5bc5df0c0166406db6153b8edf67c23ea7e976b762f6083b4d075b8c5f10098f

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 02:44

Target

f01e4bf4e3ce1ef9316d37e6d6c66a99_JaffaCakes118.dll
Size

60KB
MD5

f01e4bf4e3ce1ef9316d37e6d6c66a99
SHA1

74aebda55a272900aef54b41f8c476e4cfe37170
SHA256

5bc5df0c0166406db6153b8edf67c23ea7e976b762f6083b4d075b8c5f10098f
SHA512

92b2590041d8cd7648bc32889cf3b872fb95854f8cc4ea0cc6eb07af799bbcacd009e60edf2908c230f99c3536767e0efd42db3fd15336edaf83993476bc6654
SSDEEP

768:nbY4lPl94PFBfgMk5jFV5EbNOFlM/eLzl8RXZpLG0oLwJFZaUTVdgTWrM6neSwtA:EGf4PPgMwuAFe/1JqbcJJhdoN6ne1A

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3640-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 3640	5088	rundll32.exe	82
PID 5088 wrote to memory of 3640	5088	rundll32.exe	82
PID 5088 wrote to memory of 3640	5088	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f01e4bf4e3ce1ef9316d37e6d6c66a99_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f01e4bf4e3ce1ef9316d37e6d6c66a99_JaffaCakes118.dll,#1
  2⤵
  PID:3640

memory/3640-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download