185f76975fac7f26819373b707de7c5a8a772bb0245b14d81f2da7b16785e0d0

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 14:30

Target

06d66a3cf50f731ba74f1dd0151e5677_JaffaCakes118.dll
Size

36KB
MD5

06d66a3cf50f731ba74f1dd0151e5677
SHA1

22779aba9aed8f628a0dbfd178733bd29111ecc5
SHA256

185f76975fac7f26819373b707de7c5a8a772bb0245b14d81f2da7b16785e0d0
SHA512

f884d6e8c88fea3007f55ae492d6ba294e3f23055825728c2d7a760a820dc19fdc46941890eb246192470fc74e2fa632bc8b101b7d1bad7ea9279cf997b66a88
SSDEEP

768:XluSW1g5jyNG1fQng5eLhM+eRM7VdtZP3beMawPCD+EabAN1G3NhR4k:Xl4G5jxQng5shPeRM7/tFreNwPWv/Gdl

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1300-0-0x0000000010000000-0x000000001001C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1300	2380	rundll32.exe	82
PID 2380 wrote to memory of 1300	2380	rundll32.exe	82
PID 2380 wrote to memory of 1300	2380	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06d66a3cf50f731ba74f1dd0151e5677_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06d66a3cf50f731ba74f1dd0151e5677_JaffaCakes118.dll,#1
  2⤵
  PID:1300

memory/1300-0-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download