28f6c2bc3bf55eb9a683bb81258c3996043964a915c043e0fbd6318f9e5d07cd

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 22:32

Target

f6b745f4fc6bf809a52c7e2c43798f62_JaffaCakes118.dll
Size

43KB
MD5

f6b745f4fc6bf809a52c7e2c43798f62
SHA1

c878c19f9229c86161a2dc1c218205793e1315bf
SHA256

28f6c2bc3bf55eb9a683bb81258c3996043964a915c043e0fbd6318f9e5d07cd
SHA512

cea63f51c21855c8a0ae34df488c1131e8af0775622943e7c1847dd0467727f046518d8aee5f58faa744258c49735229828f0db8e17e729a1ed81d8d9f008b05
SSDEEP

768:NLq4/GmuTkzrda6+K0f+kXjb6hXsW4gPwe1JtM+8mzD+E0XrA4rmdU:5qUzHda3K8BXjbY3PwetULXrA4rm

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2280-0-0x0000000020000000-0x0000000020022000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 2280	3628	regsvr32.exe	81
PID 3628 wrote to memory of 2280	3628	regsvr32.exe	81
PID 3628 wrote to memory of 2280	3628	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f6b745f4fc6bf809a52c7e2c43798f62_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f6b745f4fc6bf809a52c7e2c43798f62_JaffaCakes118.dll
  2⤵
  PID:2280

memory/2280-0-0x0000000020000000-0x0000000020022000-memory.dmp

Filesize
136KB

Download