7d7a7d796940fd5cc0c229c800f94b73581f6beb2859f761bad392ce8f255b34

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 05:02

Target

0cadfabccbe3d0118af37e26dbe59248_JaffaCakes118.dll
Size

130KB
MD5

0cadfabccbe3d0118af37e26dbe59248
SHA1

d121722a745d680004467430980504c248f46977
SHA256

7d7a7d796940fd5cc0c229c800f94b73581f6beb2859f761bad392ce8f255b34
SHA512

e1b66cb6c77fe07f45f99aa2a7ec60976c60f120713e59b9bb304f895998873a56de348588389039d0ee4f59c001f56d10cca8f12ba9c64c4c3c82dc13c0fcdc
SSDEEP

1536:gYvRN3uV/DD8eEznhBbgA6U616tOmiCH+r5+BX6p20vGN8tBrYdadpRpIhGgIi6b:DvvKIXjhA1YjB+r5+hH0DW8gIfuuYUX

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/588-0-0x0000000010000000-0x0000000010012000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 588	232	rundll32.exe	82
PID 232 wrote to memory of 588	232	rundll32.exe	82
PID 232 wrote to memory of 588	232	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cadfabccbe3d0118af37e26dbe59248_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cadfabccbe3d0118af37e26dbe59248_JaffaCakes118.dll,#1
  2⤵
  PID:588

memory/588-0-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download