1797a251161bd137f1434f61fc0eb88037d36255678f6b937c97e65c6848cc62

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 14:17

Target

0901f3836dd0d15dc088dc6b750d1880_JaffaCakes118.dll
Size

144KB
MD5

0901f3836dd0d15dc088dc6b750d1880
SHA1

2a52291204cbb913740110210b35b31d8ba0be19
SHA256

1797a251161bd137f1434f61fc0eb88037d36255678f6b937c97e65c6848cc62
SHA512

be867bfe740b621a6faf7d8a6761121a64e58f8bc3e5f4e58df181990e6cbe26406e7d62c9c34820a850aef42b26517928e64e7dd2a6d453dfbb845644ea6ed5
SSDEEP

1536:c7JEbW2g8Hjy6r42B4nc8LijHrlmPodaFtiM/vlZu5AiBIIttPHpFr3:c0WAHLYLinlsod2cWKqIttP

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4200-4-0x00000000029F0000-0x00000000029FD000-memory.dmp	upx
behavioral2/memory/4200-3-0x00000000029F0000-0x00000000029FD000-memory.dmp	upx
behavioral2/memory/4200-0-0x00000000029F0000-0x00000000029FD000-memory.dmp	upx
behavioral2/memory/4200-7-0x00000000029F0000-0x00000000029FD000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 4200	968	rundll32.exe	80
PID 968 wrote to memory of 4200	968	rundll32.exe	80
PID 968 wrote to memory of 4200	968	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0901f3836dd0d15dc088dc6b750d1880_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0901f3836dd0d15dc088dc6b750d1880_JaffaCakes118.dll,#1
  2⤵
  PID:4200

memory/4200-4-0x00000000029F0000-0x00000000029FD000-memory.dmp

Filesize
52KB

Download
memory/4200-3-0x00000000029F0000-0x00000000029FD000-memory.dmp

Filesize
52KB

Download
memory/4200-0-0x00000000029F0000-0x00000000029FD000-memory.dmp

Filesize
52KB

Download
memory/4200-5-0x00000000029D0000-0x00000000029D1000-memory.dmp

Filesize
4KB

Download
memory/4200-7-0x00000000029F0000-0x00000000029FD000-memory.dmp

Filesize
52KB

Download
memory/4200-6-0x00000000029E0000-0x00000000029E6000-memory.dmp

Filesize
24KB

Download