7171d4b5d2b836a4fd79a0bc148e5d8719cc39b40e17325a033ce538cdd913f2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 08:03

Target

19620b295ee70d9e596095f014af0a48_JaffaCakes118.dll
Size

66KB
MD5

19620b295ee70d9e596095f014af0a48
SHA1

e2d20aaca33ee99cc1b2e6c20f011b91ea19f80a
SHA256

7171d4b5d2b836a4fd79a0bc148e5d8719cc39b40e17325a033ce538cdd913f2
SHA512

5b8e1b2422f1173d8fbee179aebb53471897b65183ba3e8bc45990d39effcda1174f40273842ce823826f9accd3dfbd3383112158dda0394be110ad1253357d8
SSDEEP

1536:n56EgIwI/DVyyd1YaEsJ+a5xLuF1vFf9sI8Qn:n56BtILV1d1usJ+a50Rj

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4464-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 4464	64	rundll32.exe	81
PID 64 wrote to memory of 4464	64	rundll32.exe	81
PID 64 wrote to memory of 4464	64	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\19620b295ee70d9e596095f014af0a48_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:64
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\19620b295ee70d9e596095f014af0a48_JaffaCakes118.dll,#1
  2⤵
  PID:4464

memory/4464-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download