3abd348bf66e373a5fdc42968e3cf3fb0b7a64cba2f87f29fadcdea101268032

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 04:38

Target

fe73e8708fd6004268e8e6c9eb17e621_JaffaCakes118.dll
Size

67KB
MD5

fe73e8708fd6004268e8e6c9eb17e621
SHA1

2711fbd0353840d7c783d2dfffdfbcfcdf926d1d
SHA256

3abd348bf66e373a5fdc42968e3cf3fb0b7a64cba2f87f29fadcdea101268032
SHA512

d40f424f4675d269ab1cceaf748ecf139eb270bcb8fb3d7a1073aae366ea469fd55484835d872d13e7533457e2fb041fd7dfb641739590bb984f00d02538e334
SSDEEP

1536:zt5RuePwOEeyyLbHFlVWeqJrJKX2Vaehhu9TgShRmcPhVJP4J2IWG7K:1uREy0hq2XIRShRmuhzhQ7K

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3296-0-0x0000000010000000-0x0000000010042000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 3296	4912	rundll32.exe	85
PID 4912 wrote to memory of 3296	4912	rundll32.exe	85
PID 4912 wrote to memory of 3296	4912	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe73e8708fd6004268e8e6c9eb17e621_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe73e8708fd6004268e8e6c9eb17e621_JaffaCakes118.dll,#1
  2⤵
  PID:3296

memory/3296-0-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download