cf2ab64aa9ba316f22aeff68a6b67c384e1909570babc230cee815f74c0465db

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 06:26

Target

191c99ca59efb5109c6348ec21baf49a_JaffaCakes118.dll
Size

13KB
MD5

191c99ca59efb5109c6348ec21baf49a
SHA1

d63d19ed0f0b7a24efa41eea17b2da1c2d646a7e
SHA256

cf2ab64aa9ba316f22aeff68a6b67c384e1909570babc230cee815f74c0465db
SHA512

f1743470185db3b6e9df9dc1311cf46e628511b5a60e253258200221b206130a4e554790f2cb4e393e7098666492928b0953c5741911a7edce6c9540eb6f6555
SSDEEP

192:sqtQ6O+OkNybTYeez3VWxZNseZX6V2oPITvI+YminskWbPp5/kXK+cM9sT3QB:sqQhk4PYeeRWxZNZtkrinahkpJkXZ+

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3116-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 3116	380	rundll32.exe	81
PID 380 wrote to memory of 3116	380	rundll32.exe	81
PID 380 wrote to memory of 3116	380	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\191c99ca59efb5109c6348ec21baf49a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\191c99ca59efb5109c6348ec21baf49a_JaffaCakes118.dll,#1
  2⤵
  PID:3116

memory/3116-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download