97084184629a3182728ac0f3706bec384cb53d3fbbf1e3a61801f9caa0e762bd

Analysis

max time kernel
134s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 09:19

Target

1abe1aff0a4168e581940e6f6ae793fc_JaffaCakes118.dll
Size

62KB
MD5

1abe1aff0a4168e581940e6f6ae793fc
SHA1

13902a7709986fd0b4075f9bda475fddc817d5ed
SHA256

97084184629a3182728ac0f3706bec384cb53d3fbbf1e3a61801f9caa0e762bd
SHA512

31bed8d0c1b39c357cef1f892d571f3ec2fb7ca44681a1b027b3d0636c4dd9c6c778862357bde3397b059892efd159fcf49ab779ca1bf1aec1e47e5b9c06ef98
SSDEEP

1536:23umoMtxLXBGptaHm89lBgrWlb9xShwV9O:CoMtxjBHmclGrGb9xShn

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2944-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 2944	4364	rundll32.exe	83
PID 4364 wrote to memory of 2944	4364	rundll32.exe	83
PID 4364 wrote to memory of 2944	4364	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1abe1aff0a4168e581940e6f6ae793fc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1abe1aff0a4168e581940e6f6ae793fc_JaffaCakes118.dll,#1
  2⤵
  PID:2944

memory/2944-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download