5fcba9d256b2298c32d939c30fbc29f92ee27532f0490a3141bda93aaa7c74fc

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 23:46

Target

013f5f6f344771c8b01073e012fbdde1_JaffaCakes118.dll
Size

247KB
MD5

013f5f6f344771c8b01073e012fbdde1
SHA1

7c52333e1f1ba66c72814f7457157d86224518be
SHA256

5fcba9d256b2298c32d939c30fbc29f92ee27532f0490a3141bda93aaa7c74fc
SHA512

20e830c2675ddeb0e44aaa91ba6daefe6a6d84c241a33906ee8f68db97b16633b5710d17509e27fbd2c1eb1660c3fe5eadb42d12229c5aa977dc87ad2e9e53a1
SSDEEP

6144:BkNG+NdkuFGXBYV3APFkvCN6J+zUwvWgxUa:BkDNd3GXBi3UFkvfJ+4+Tt

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3156-1-0x0000000010000000-0x00000000100A4000-memory.dmp	upx
behavioral2/memory/3156-2-0x0000000010000000-0x00000000100A4000-memory.dmp	upx
behavioral2/memory/3156-5-0x0000000010000000-0x00000000100A4000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3156	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 3156	1416	rundll32.exe	82
PID 1416 wrote to memory of 3156	1416	rundll32.exe	82
PID 1416 wrote to memory of 3156	1416	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\013f5f6f344771c8b01073e012fbdde1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\013f5f6f344771c8b01073e012fbdde1_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3156

memory/3156-3-0x0000000002230000-0x000000000226C000-memory.dmp

Filesize
240KB

Download
memory/3156-1-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/3156-0-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/3156-4-0x000000001006C000-0x00000000100A3000-memory.dmp

Filesize
220KB

Download
memory/3156-2-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/3156-5-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download