2bf4549ffaf3fa93bf9898baf8f8b7f7b0bfe4b227bad7359a0e57fbc0653949

Analysis

max time kernel
133s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 08:20

Target

154d36bb01d0d250ef7ab0318a0c2d70_JaffaCakes118.dll
Size

81KB
MD5

154d36bb01d0d250ef7ab0318a0c2d70
SHA1

b890d3a2aec1296138de07c1a45fd830477dd5e9
SHA256

2bf4549ffaf3fa93bf9898baf8f8b7f7b0bfe4b227bad7359a0e57fbc0653949
SHA512

50bbe794cfdf100d16d60a0d225fde65cbe3b4b09ff9b88eccb6ff1d32960f61a797d198e78cc991612fafeb9f0ff51c9a4171d82a4662a949438aab5a1f994f
SSDEEP

1536:xNWujxA5EY8DwKtNKT63JK/6L8mZOQ1ndiL:u/2Y80yNm6Y/6QCr8

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1592-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1592	2000	rundll32.exe	90
PID 2000 wrote to memory of 1592	2000	rundll32.exe	90
PID 2000 wrote to memory of 1592	2000	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\154d36bb01d0d250ef7ab0318a0c2d70_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\154d36bb01d0d250ef7ab0318a0c2d70_JaffaCakes118.dll,#1
  2⤵
  PID:1592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4088,i,2113996974559895641,18156918660790954073,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
1⤵
PID:2040

memory/1592-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download