c2cf6cc50b902e47c15557b0857b847fbad5fda7a496c635fab96fee0f8763eb

Analysis

max time kernel
129s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 12:05

Target

2257115d04cd62cf5a17204c785308ef_JaffaCakes118.dll
Size

101KB
MD5

2257115d04cd62cf5a17204c785308ef
SHA1

d13aab55fb7d65428d515317787aecc84a7c50b3
SHA256

c2cf6cc50b902e47c15557b0857b847fbad5fda7a496c635fab96fee0f8763eb
SHA512

51e298904e3835d2e692a528cceeaf0f832b8d4f6be271984f499bb9d83bd8e97de63cc62ffe715d9bd09c7d9ad09db7213a9df74e296de5df35b3c751d61d0d
SSDEEP

1536:Xrj2DTisS3kalQA86RIgOSqB+ftXpKEZI0+T24G3/SuIeazvPfrwILCjorOTr:v2DTv1alQ8IgOZ+ftV+T2ZKbPfBLioC

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4136-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 4136	3252	rundll32.exe	83
PID 3252 wrote to memory of 4136	3252	rundll32.exe	83
PID 3252 wrote to memory of 4136	3252	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2257115d04cd62cf5a17204c785308ef_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2257115d04cd62cf5a17204c785308ef_JaffaCakes118.dll,#1
  2⤵
  PID:4136

memory/4136-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download