701a7952d382c0774a510c934a4b590e5459d6e106e54556c34697685cc321ff

Analysis

max time kernel
94s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 10:29

Target

fa1ab88d5447fb3c3711d65aba635a0b_JaffaCakes118.dll
Size

5KB
MD5

fa1ab88d5447fb3c3711d65aba635a0b
SHA1

3384d36d839a3fc35d1f4b18627a93cb22de9544
SHA256

701a7952d382c0774a510c934a4b590e5459d6e106e54556c34697685cc321ff
SHA512

eb0731585f399e54c55539a84a9c26b641d2396dc3b99884c027c4ae9941739b7aea36eb6e596c410249bff5dded9d5157e6b6e211a7ad87fdf6083815f9d963
SSDEEP

48:SYxs7l2mxeudMrwcnPZ7XTYvigbQqGGWONh2JpMmH7eRoafJ2JjFkl8jNzyf5lAY:Z+TdMtnh7cOuVh23703fJRMQDCev

Score

7^/10

upx

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/2904-0-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect
behavioral2/memory/2904-1-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2904-0-0x0000000010000000-0x000000001010B000-memory.dmp	upx
behavioral2/memory/2904-1-0x0000000010000000-0x000000001010B000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2904	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 2904	544	rundll32.exe	85
PID 544 wrote to memory of 2904	544	rundll32.exe	85
PID 544 wrote to memory of 2904	544	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa1ab88d5447fb3c3711d65aba635a0b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa1ab88d5447fb3c3711d65aba635a0b_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2904

memory/2904-0-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download
memory/2904-1-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download