69cfca1f7b667be175e55dc1ff3818aebd8c395058e03a761c19fb800c3de084

Analysis

max time kernel
114s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 16:16

Target

f854cc1717409b3355d9fdcbeb96e353_JaffaCakes118.dll
Size

57KB
MD5

f854cc1717409b3355d9fdcbeb96e353
SHA1

e29d2f979f26394f8a22bd84daf9585f71edaa84
SHA256

69cfca1f7b667be175e55dc1ff3818aebd8c395058e03a761c19fb800c3de084
SHA512

680470af8181e2eee65e3048e31110bda6c87af53608394edfb7f0b72eda1c286361035f0f042dd43ed04e4ddef599f64821eb33fb4cea0c7a4b4d81adb91345
SSDEEP

1536:1zExMwCGQ2jBszosbXcmw4SATvfd5nzqqDpa0Glne7i/e6cx4MTk:1I+wCGv0s94ZvFRA0Gle7csJk

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1704-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1704	1380	rundll32.exe	91
PID 1380 wrote to memory of 1704	1380	rundll32.exe	91
PID 1380 wrote to memory of 1704	1380	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f854cc1717409b3355d9fdcbeb96e353_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f854cc1717409b3355d9fdcbeb96e353_JaffaCakes118.dll,#1
  2⤵
  PID:1704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1400 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:2324

memory/1704-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download