7b9c9d02eb66321bf881375c089feb2d08917b024ccd02d34e5df2c41451d1d1

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 00:13

Target

fdfa190cde1ace94668fdad2381ff242_JaffaCakes118.dll
Size

95KB
MD5

fdfa190cde1ace94668fdad2381ff242
SHA1

4135f8ba230c85262f6e82bacc181f5728e50f09
SHA256

7b9c9d02eb66321bf881375c089feb2d08917b024ccd02d34e5df2c41451d1d1
SHA512

5d4b964648cec2285da7cbbbef981f5b9926dd2e0bd2c7d18b151af0ad434af41ce324d980c1fc909738c2c10070c1e12fd05ac225e0b05a814cb25dd60a6cf0
SSDEEP

1536:SQclh8MIwu5+oYqNENrm1x5BpCINR9qiaR8uIFQVK2:ahdIw/oYqNE1m1HBrNRAiaRR8QVZ

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4708-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4708	4932	rundll32.exe	85
PID 4932 wrote to memory of 4708	4932	rundll32.exe	85
PID 4932 wrote to memory of 4708	4932	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fdfa190cde1ace94668fdad2381ff242_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fdfa190cde1ace94668fdad2381ff242_JaffaCakes118.dll,#1
  2⤵
  PID:4708

memory/4708-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download