a7b0f0d3a88060cd592178aebbf1fe7dd4b01861c2597d48baca193d82883d4e

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 12:43

Target

06146672e761825a04a0fb2ff755fd5d_JaffaCakes118.dll
Size

66KB
MD5

06146672e761825a04a0fb2ff755fd5d
SHA1

1612bdaaca81599148e72665bb3cdff7308343d7
SHA256

a7b0f0d3a88060cd592178aebbf1fe7dd4b01861c2597d48baca193d82883d4e
SHA512

398315f10fa3d69d686b7f38a9412ab018e023a62d9e84645f86c23fa8d8a97f7d1ffac7fe8aa0f3becf155df7a55b01349b3219d2f83a17e76be75bf534acbd
SSDEEP

1536:q+gWgHmrDQruewAsgbUdpFkIop/FPAdE3CbZ6EloS2tTE0po9nlYiM:IOgruewQek5heC3CGNY069S7

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1300-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 1300	4288	rundll32.exe	84
PID 4288 wrote to memory of 1300	4288	rundll32.exe	84
PID 4288 wrote to memory of 1300	4288	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06146672e761825a04a0fb2ff755fd5d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06146672e761825a04a0fb2ff755fd5d_JaffaCakes118.dll,#1
  2⤵
  PID:1300

memory/1300-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download