308686029ca5d47970d13734c61475d542fcf7115427fd905966becfdd7a21a6

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 20:17

Target

004d72bd5838de41a3c79cd2e556e8ba_JaffaCakes118.dll
Size

59KB
MD5

004d72bd5838de41a3c79cd2e556e8ba
SHA1

89285cfd3803d5f83ca2c7f8a504390f6585892e
SHA256

308686029ca5d47970d13734c61475d542fcf7115427fd905966becfdd7a21a6
SHA512

1ade6dcebbf4c2571014387fb4338c71facdb4eeda5be8f4bc16a9704ae0d3eae8d5831d0aaa61c19d908e97f44ac5ec11dd611565f1c97077246b0390c695a4
SSDEEP

768:I7BjcKCpgpbCzw0SnEAv3H0tiYlq1/Qk+ps0e9TQJjl6MWP5jFI0oe6IWrsBwmsA:rpgtIwZnvciDQkyCclrG5pI0otr4/

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4488-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 4488	1672	rundll32.exe	83
PID 1672 wrote to memory of 4488	1672	rundll32.exe	83
PID 1672 wrote to memory of 4488	1672	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\004d72bd5838de41a3c79cd2e556e8ba_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\004d72bd5838de41a3c79cd2e556e8ba_JaffaCakes118.dll,#1
  2⤵
  PID:4488

memory/4488-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download