fb6c38c023bef99f703fd235324c0b41c6839f326f84640e3a712b591c2eb92b

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 12:40

Target

160b7f25df6c33e345365ba3d7430e33_JaffaCakes118.dll
Size

86KB
MD5

160b7f25df6c33e345365ba3d7430e33
SHA1

a2adc8f80c7bbaa0d75679bca0ca662c4dbf120b
SHA256

fb6c38c023bef99f703fd235324c0b41c6839f326f84640e3a712b591c2eb92b
SHA512

8fa7c46d7db93c2876b19f5d25fc5c48bbaa1a5001506a59fdfe2861417d18b3c3df9c68efc9d120f8999a517edc3dd69df3892e1022dd8402b57a0b390a931c
SSDEEP

1536:fYvynn+A2VjSCRZO0kmFrEqZRnsYHTgSJgTKM4mNssHhwdx8GNxD:wv4+Ay00Hp5RnshJKELhg8GDD

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1464-0-0x0000000000400000-0x000000000043C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6104 wrote to memory of 1464	6104	regsvr32.exe	82
PID 6104 wrote to memory of 1464	6104	regsvr32.exe	82
PID 6104 wrote to memory of 1464	6104	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\160b7f25df6c33e345365ba3d7430e33_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:6104
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\160b7f25df6c33e345365ba3d7430e33_JaffaCakes118.dll
  2⤵
  PID:1464

memory/1464-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download