bf008ba193d4a8860ca6cf1962784c853ccf0c012b6e38655a12c138de4f5423

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 12:21

Target

05f0c9eb4e75df6279fa63b088eda728_JaffaCakes118.dll
Size

45KB
MD5

05f0c9eb4e75df6279fa63b088eda728
SHA1

2eb2dc3776d0b014784affb5c7d0cc99bec64516
SHA256

bf008ba193d4a8860ca6cf1962784c853ccf0c012b6e38655a12c138de4f5423
SHA512

1b0a1d889f001906283049100e133d56cad00e06e5f9b2f06e1d9bd7166f59287a84d571e088e147f131c359b581b52b09fc9774a0e8071f953b1a0479c20934
SSDEEP

768:Jbz3Lf28NznzoEWoueAgKMxYDB9xMxXc7nx4/wjNwbp7P9/+uLWO9485M/p7q8B:Jbz3CQzoyO/xYu4IjS9P9D94hH

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2968-0-0x0000000010000000-0x0000000010020000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\ydupisqn.job	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 2968	896	rundll32.exe	81
PID 896 wrote to memory of 2968	896	rundll32.exe	81
PID 896 wrote to memory of 2968	896	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05f0c9eb4e75df6279fa63b088eda728_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05f0c9eb4e75df6279fa63b088eda728_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  PID:2968

memory/2968-0-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download