5ae045ac6408b0ba10e81acbf7205f5d01d7747388f84a30d2adfea3ba54b573

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 01:38

Target

0bd64b4a5900a4e013539e1c859aec16_JaffaCakes118.dll
Size

422KB
MD5

0bd64b4a5900a4e013539e1c859aec16
SHA1

411489342d562818e6f8e40f1a38c60dad5e38e8
SHA256

5ae045ac6408b0ba10e81acbf7205f5d01d7747388f84a30d2adfea3ba54b573
SHA512

c85279c5599354986006d68ffa2e553613f3e814ef61aa3b8768704a6f44609fa1e86ae01a3d2b5c5c4d4e435d61be9fbe222b9bd794c9142aa194f859f1afc9
SSDEEP

12288:eQPVdPwRci5vbQ/cC99XgWcMv+lp76MRPb8:eQPVdPqzbULXgWci+lN6cg

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3476-0-0x0000000000400000-0x0000000000477000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 3476	812	rundll32.exe	80
PID 812 wrote to memory of 3476	812	rundll32.exe	80
PID 812 wrote to memory of 3476	812	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bd64b4a5900a4e013539e1c859aec16_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bd64b4a5900a4e013539e1c859aec16_JaffaCakes118.dll,#1
  2⤵
  PID:3476

memory/3476-0-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download