855032a6e937adb29485839e3374bc31c750ce51c8ec212004fcfd4f5ca90cf3

Analysis

max time kernel
79s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 14:30

Target

1ba7b85a91f9b22b4d052a666496bcbb_JaffaCakes118.dll
Size

94KB
MD5

1ba7b85a91f9b22b4d052a666496bcbb
SHA1

079a672b63fb5e74db35998b72fe50c94302c043
SHA256

855032a6e937adb29485839e3374bc31c750ce51c8ec212004fcfd4f5ca90cf3
SHA512

0d5ff8e62f5a27633b4f6146609f35721ab9912093ff5b3d9b4819ec3695d2884ee38aaabbee9228780d5196a5d383e75047ea53ffe5fc79565ae09e185a13fa
SSDEEP

1536:Xrj2DTisS3kalQqjFiZmPjdBWeu8kExIcG6QL7wX156gvMM3VpWJ8r:v2DTv1alQqjFRIeE6QLEl5ZMRJu

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1572-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1572	1456	rundll32.exe	80
PID 1456 wrote to memory of 1572	1456	rundll32.exe	80
PID 1456 wrote to memory of 1572	1456	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ba7b85a91f9b22b4d052a666496bcbb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ba7b85a91f9b22b4d052a666496bcbb_JaffaCakes118.dll,#1
  2⤵
  PID:1572

memory/1572-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download