327052b4f32f5cb23ad27313962cc2f2400bcf09e6f7a704635de4480f2741ca

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/06/2024, 01:49

Target

10519b7e3e8b4ada581aed2ef92c5fc7_JaffaCakes118.dll
Size

133KB
MD5

10519b7e3e8b4ada581aed2ef92c5fc7
SHA1

4af8f87a0b7f1d6ddf4ff04123c5fcc80c33c242
SHA256

327052b4f32f5cb23ad27313962cc2f2400bcf09e6f7a704635de4480f2741ca
SHA512

49dfd55358917215105537b898cd913faff96b19b08208d4a6698ae578455e85b6ca9200f126ac93dbbec9f6364f991c8b2258cc2d5edd6b157ce163c16bb8e7
SSDEEP

1536:6Rw9k6k1FrHc5+kvI5sJPSnnpkksrctAY5ftEbUUArl128/V:/cHr85vO0PqpkNUAYro6128/V

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1664-0-0x0000000010000000-0x0000000010017000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 1664	3568	rundll32.exe	80
PID 3568 wrote to memory of 1664	3568	rundll32.exe	80
PID 3568 wrote to memory of 1664	3568	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\10519b7e3e8b4ada581aed2ef92c5fc7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\10519b7e3e8b4ada581aed2ef92c5fc7_JaffaCakes118.dll,#1
  2⤵
  PID:1664

memory/1664-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download