4653ba6cbd5a01d01515d0f82c9c86903582cad6ac25d0f1074a489337bb7b5d

Analysis

max time kernel
138s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 17:37

Target

0ef34baebf5cd5d146acb140de7ef12e_JaffaCakes118.dll
Size

65KB
MD5

0ef34baebf5cd5d146acb140de7ef12e
SHA1

db49c0765bc5faa41974897799ccd87206765e76
SHA256

4653ba6cbd5a01d01515d0f82c9c86903582cad6ac25d0f1074a489337bb7b5d
SHA512

cbfcc79c530c557843bd652bf9b533e222a63cb3967d29ec0e37963ed4e3a04d856856cdb975108dc54ff3f8505967a8db3da4ce2d911b768e3b2f056e5a58d2
SSDEEP

1536:yl3E0TpJt92YPo2T5gPPlr83KHI7LQ4TYocUV5ehKrSC:E39L2N2T5Kh83OI7M1ocXEWC

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4752-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 4752	740	rundll32.exe	82
PID 740 wrote to memory of 4752	740	rundll32.exe	82
PID 740 wrote to memory of 4752	740	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ef34baebf5cd5d146acb140de7ef12e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ef34baebf5cd5d146acb140de7ef12e_JaffaCakes118.dll,#1
  2⤵
  PID:4752

memory/4752-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download