c3964e40f72ac8425bcccbc05e73d0e620d88ce921ab345dd735b4de68a10870

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 13:11

Target

0e33afc2487a1fa229c92bb136d8d436_JaffaCakes118.dll
Size

70KB
MD5

0e33afc2487a1fa229c92bb136d8d436
SHA1

5067d531ebe1822981361cc078c6cf199f2f9ea9
SHA256

c3964e40f72ac8425bcccbc05e73d0e620d88ce921ab345dd735b4de68a10870
SHA512

1817fa7667a53a2c8338c45159e658bcbdf12a4865f099bb4c947a6bff7271d170b1ff21b56fddb57686a51a36b1116a5d0cfb3f8fcd49c52de9f68af5081773
SSDEEP

1536:1aT/Cjc03U5DXUAVAyJu4e4eUV6KPNF0lv9ePKcvBerm:cKjc03UE4e6lPNFgv90vBerm

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2728-0-0x0000000000400000-0x0000000000429000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2728	2920	regsvr32.exe	83
PID 2920 wrote to memory of 2728	2920	regsvr32.exe	83
PID 2920 wrote to memory of 2728	2920	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0e33afc2487a1fa229c92bb136d8d436_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0e33afc2487a1fa229c92bb136d8d436_JaffaCakes118.dll
  2⤵
  PID:2728

memory/2728-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download