cdd4dd02c02502672a4a6b0e26143e4961ef48f3d031de1bec547e4c29a6b4ea

Analysis

max time kernel
134s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 04:09

Target

210780589173c02178b320663d763810_JaffaCakes118.dll
Size

1.1MB
MD5

210780589173c02178b320663d763810
SHA1

6ef6d164d5866ed51498f05238ce62bf9c8e8983
SHA256

cdd4dd02c02502672a4a6b0e26143e4961ef48f3d031de1bec547e4c29a6b4ea
SHA512

6e3a3ffcb7a46c2bfc54b5553964ff4d2f67cdf438b149b9b4047ac936bc08113c3638400a0b102fc67a22adafdd115471a11793febe021723174c998ede02da
SSDEEP

12288:MMpc1kF6rPOAD5k5aFU86fdVEt5EU0PqbZPMgzh:ve1dJD5k5aFUdfd8EU065p

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1876-0-0x0000000010000000-0x00000000101FC000-memory.dmp	upx
behavioral2/memory/1876-1-0x0000000010000000-0x00000000101FC000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 1876	1196	rundll32.exe	82
PID 1196 wrote to memory of 1876	1196	rundll32.exe	82
PID 1196 wrote to memory of 1876	1196	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\210780589173c02178b320663d763810_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\210780589173c02178b320663d763810_JaffaCakes118.dll,#1
  2⤵
  PID:1876

memory/1876-0-0x0000000010000000-0x00000000101FC000-memory.dmp

Filesize
2.0MB

Download
memory/1876-1-0x0000000010000000-0x00000000101FC000-memory.dmp

Filesize
2.0MB

Download