6e3000dffa758c25fed6d1ffc1d5f0233aa1109abe6f09a98856c98e7e1299d7

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 05:17

Target

f2c4cc6811f8c690daba08df46f8595b_JaffaCakes118.dll
Size

55KB
MD5

f2c4cc6811f8c690daba08df46f8595b
SHA1

3d72d7e63c5476d173ddce9115dd5f7b0ab45b92
SHA256

6e3000dffa758c25fed6d1ffc1d5f0233aa1109abe6f09a98856c98e7e1299d7
SHA512

3529b4d27f3d8de6b2b2fb1e10fbec91622470cb9ee02c04f9d8a50764f3d038c61c8e9c5020971d95f3c03045eac96e0b1bb8ea3b40ee1b8146611352fc41f7
SSDEEP

1536:yl3E0TjT436xNOa2SnCJJv+kAP+Pozrpa:E39yoNOa2SnSJWkAmPJ

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4156-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 4156	4484	rundll32.exe	85
PID 4484 wrote to memory of 4156	4484	rundll32.exe	85
PID 4484 wrote to memory of 4156	4484	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2c4cc6811f8c690daba08df46f8595b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2c4cc6811f8c690daba08df46f8595b_JaffaCakes118.dll,#1
  2⤵
  PID:4156

memory/4156-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download