f2e5da176b759265756acfe64d921384e08d13d66610251ad18517fe9d9613e6

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 18:32

Target

235866a32ae2354dff567bbc65860393_JaffaCakes118.dll
Size

61KB
MD5

235866a32ae2354dff567bbc65860393
SHA1

f4d846357e940192e1f486c58a9e8acfa3aaff0a
SHA256

f2e5da176b759265756acfe64d921384e08d13d66610251ad18517fe9d9613e6
SHA512

a47b6188724e3a7c788c767ae382db99046bf914a986acd011e691a265009165dd8a8ccb09015078f5e7a6511e1bb698db5f958c8faf26f8630d2c838e89e3bd
SSDEEP

768:aTeWqa4wq+/QIc9I0EbY2GdLWswED73AejDQM0x6XrBKTK0nb6lVOFxw72nx64zs:vWKwR903cJW73MMfrHjlgU72nQTGU

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4252-0-0x0000000010000000-0x000000001002C000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4252	rundll32.exe
4252	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 4252	4580	rundll32.exe	80
PID 4580 wrote to memory of 4252	4580	rundll32.exe	80
PID 4580 wrote to memory of 4252	4580	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\235866a32ae2354dff567bbc65860393_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\235866a32ae2354dff567bbc65860393_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4252

memory/4252-0-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download