3da56751406fc5c37bca4004f390c810e7a593be0eb5819c018cf39b6b881c13

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 14:46

Target

1bb470bcabe1c4214de9704261b991a9_JaffaCakes118.dll
Size

62KB
MD5

1bb470bcabe1c4214de9704261b991a9
SHA1

c34766c84580015b3d587381e214c706fd382d7a
SHA256

3da56751406fc5c37bca4004f390c810e7a593be0eb5819c018cf39b6b881c13
SHA512

6041a28bebc2336a853e685f82be430f08a1720f7624eedc33db58cdc1328f35ad30625454827753ba1c3520b7b9bc67773f6a67411e7ba022bdf4f9279e4bbb
SSDEEP

1536:7oFeOzU6/NKNkoLVRY5uDIwDfwyq/2ZNYMnrRXDE5:wjNKNbewJa2ZNYMnrtDE

Score

7^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4504-4-0x0000000000CB0000-0x0000000000CBE000-memory.dmp	upx
behavioral2/memory/4504-1-0x0000000000CB0000-0x0000000000CBE000-memory.dmp	upx
behavioral2/memory/4504-5-0x0000000000CB0000-0x0000000000CBE000-memory.dmp	upx
behavioral2/memory/4504-6-0x0000000000CB0000-0x0000000000CBE000-memory.dmp	upx
behavioral2/memory/4504-7-0x0000000000CB0000-0x0000000000CBE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 4504	2888	rundll32.exe	93
PID 2888 wrote to memory of 4504	2888	rundll32.exe	93
PID 2888 wrote to memory of 4504	2888	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb470bcabe1c4214de9704261b991a9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1bb470bcabe1c4214de9704261b991a9_JaffaCakes118.dll,#1
  2⤵
  PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4148 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:4284

memory/4504-4-0x0000000000CB0000-0x0000000000CBE000-memory.dmp

Filesize
56KB

Download
memory/4504-0-0x0000000000C90000-0x0000000000C96000-memory.dmp

Filesize
24KB

Download
memory/4504-1-0x0000000000CB0000-0x0000000000CBE000-memory.dmp

Filesize
56KB

Download
memory/4504-5-0x0000000000CB0000-0x0000000000CBE000-memory.dmp

Filesize
56KB

Download
memory/4504-6-0x0000000000CB0000-0x0000000000CBE000-memory.dmp

Filesize
56KB

Download
memory/4504-7-0x0000000000CB0000-0x0000000000CBE000-memory.dmp

Filesize
56KB

Download