8eb0568a33734ba1551ed45e23e50fe4e188120c4d8136e58ce2837e6190ad12

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 18:40

Target

235eed9d56899fd29d7ef265b3a527ca_JaffaCakes118.dll
Size

244KB
MD5

235eed9d56899fd29d7ef265b3a527ca
SHA1

b2d1e21ea60d3f9fb0e5947fdb8f7d662fa96cc1
SHA256

8eb0568a33734ba1551ed45e23e50fe4e188120c4d8136e58ce2837e6190ad12
SHA512

c432f1f69a090a189d336e11cf6a140297082f0de37efbf5345465f144ba9dbe0c1091c092aa4b318ff6f32d9543ae1098d2e6f7a01c53ccff57512c360d30c7
SSDEEP

6144:SnlBp/5tLyHj0Ut2/yIGMeolszuVkPkiO6hMOvC:6lBHgxUyKeo2qVgOeMOvC

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4848-2-0x0000000010000000-0x00000000100A5000-memory.dmp	upx
behavioral2/memory/4848-1-0x0000000010000000-0x00000000100A5000-memory.dmp	upx
behavioral2/memory/4848-5-0x0000000010000000-0x00000000100A5000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4848	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 4848	4640	rundll32.exe	80
PID 4640 wrote to memory of 4848	4640	rundll32.exe	80
PID 4640 wrote to memory of 4848	4640	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\235eed9d56899fd29d7ef265b3a527ca_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\235eed9d56899fd29d7ef265b3a527ca_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4848

memory/4848-3-0x0000000002CB0000-0x0000000002CEB000-memory.dmp

Filesize
236KB

Download
memory/4848-2-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download
memory/4848-1-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download
memory/4848-0-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download
memory/4848-5-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download
memory/4848-4-0x000000001006C000-0x00000000100A4000-memory.dmp

Filesize
224KB

Download