14a6199c661847a8be01af848cdc5656329bfdaf1b17e9c19e48933060f9aa95

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 05:59

Target

14ea819f7d3644e93205e29ed5b3d3b3_JaffaCakes118.dll
Size

32KB
MD5

14ea819f7d3644e93205e29ed5b3d3b3
SHA1

d1d67df4e42c92cce6da1c28e466be095fbf6935
SHA256

14a6199c661847a8be01af848cdc5656329bfdaf1b17e9c19e48933060f9aa95
SHA512

8866050b3378e8cae8bf872b8cfc514b794c3404c9d2cba477c2072748820c431f0f521a320dc15a1539f931cc9a7938922aaf1d23f254c157b68ce87e2157be
SSDEEP

768:G/KqzMGqtlokNAIrpQ3fBz5wCh8XV21KPR5M95f3A31r18wi+:GSNXgkNAIrped+V28PR5MDfmh

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1280-0-0x0000000000400000-0x000000000041A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1280	1416	rundll32.exe	81
PID 1416 wrote to memory of 1280	1416	rundll32.exe	81
PID 1416 wrote to memory of 1280	1416	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14ea819f7d3644e93205e29ed5b3d3b3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14ea819f7d3644e93205e29ed5b3d3b3_JaffaCakes118.dll,#1
  2⤵
  PID:1280

memory/1280-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download