9dac349ce61ea1d192729fede2d8593ed0b912d925a1e98979fa834488cab82a

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 02:55

Target

0c293afae2c109e7b11425c1280ca5b3_JaffaCakes118.dll
Size

44KB
MD5

0c293afae2c109e7b11425c1280ca5b3
SHA1

f9ab9831c600c6c452128b838747daf9c2101b5c
SHA256

9dac349ce61ea1d192729fede2d8593ed0b912d925a1e98979fa834488cab82a
SHA512

8c8cf569432fc474cb921290ec025665d0c3694f1426d1c2dfc0e922f103485415dd3f83baba99a31332cdf33ed2096449178579205c250b82b211b0cc7ed127
SSDEEP

768:op1VqVQwL6diO9DnPHjr4eqwIXjGTWOLo/qj/GIPiGkUEkI6pHe9HRSD0wvhgQc:ob8Vwn/r4eqwOGTWOcM/G7Xb6pHevOfG

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1020-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 1020	2828	rundll32.exe	81
PID 2828 wrote to memory of 1020	2828	rundll32.exe	81
PID 2828 wrote to memory of 1020	2828	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c293afae2c109e7b11425c1280ca5b3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c293afae2c109e7b11425c1280ca5b3_JaffaCakes118.dll,#1
  2⤵
  PID:1020

memory/1020-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download