85a817cc76b093a559a417266faa534c2a28c64bdcff37bae911afd6803620fa

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 22:23

Target

0af160a1c76c91041a1250c01742db99_JaffaCakes118.dll
Size

249KB
MD5

0af160a1c76c91041a1250c01742db99
SHA1

936366872b4284f47c382488a78762f46146a13d
SHA256

85a817cc76b093a559a417266faa534c2a28c64bdcff37bae911afd6803620fa
SHA512

97e8a570cc4503f66c51d5a339adb57ae92fa32cd53be38fefcf295fd6e78ed5eccbd75e1dd5f7c10ee25efdc39fddda44e7233ebc0dd6e808f51f9cd2b8c77c
SSDEEP

6144:x3EXRtK1AF0rK6iTHK8fAn1/ziSq63XXXqwb3e877vhZdE:s7F8KjTHjA17iRkXHqwJ793E

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2372-1-0x0000000010000000-0x00000000100A4000-memory.dmp	upx
behavioral2/memory/2372-2-0x0000000010000000-0x00000000100A4000-memory.dmp	upx
behavioral2/memory/2372-5-0x0000000010000000-0x00000000100A4000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2372	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2372	2684	rundll32.exe	81
PID 2684 wrote to memory of 2372	2684	rundll32.exe	81
PID 2684 wrote to memory of 2372	2684	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0af160a1c76c91041a1250c01742db99_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0af160a1c76c91041a1250c01742db99_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2372

memory/2372-1-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/2372-3-0x0000000002480000-0x00000000024BC000-memory.dmp

Filesize
240KB

Download
memory/2372-0-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/2372-2-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/2372-5-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/2372-4-0x000000001006C000-0x00000000100A3000-memory.dmp

Filesize
220KB

Download