957416efddf7ce74288fc5896b9103138e10e45de6cea7a101271e191c6e832f

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 11:49

Target

1a01a9cbaf9e5285a494774dc5419a4a_JaffaCakes118.dll
Size

53KB
MD5

1a01a9cbaf9e5285a494774dc5419a4a
SHA1

488c41f684dfd2457d5f35bb093c6cbabf4b77d8
SHA256

957416efddf7ce74288fc5896b9103138e10e45de6cea7a101271e191c6e832f
SHA512

1e9bdf8947cd66486a3c38796d36ebeceef2186f34d4e1f7ce8d5f32966c85a5e1f12d7d112617c737cadf2c7d460cc3e2ff0fae195b2e3596032fa41d561c38
SSDEEP

768:pWO1CClq+0XMMtCDlPTmi6qAD95e5AfDQLi0VxWJR0MKMmdhdFmnIvBPk1HmES:pWOaR1sKD9gosLCj0MeTmIv90ZS

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1500-0-0x0000000010000000-0x000000001000A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 1500	4712	rundll32.exe	83
PID 4712 wrote to memory of 1500	4712	rundll32.exe	83
PID 4712 wrote to memory of 1500	4712	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a01a9cbaf9e5285a494774dc5419a4a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a01a9cbaf9e5285a494774dc5419a4a_JaffaCakes118.dll,#1
  2⤵
  PID:1500

memory/1500-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download