434a4f687598897694f8d9bf7a714e87cf26f5c42824060442df102977661e6c

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 02:41

Target

245baada225fc281c0e29fbdd234390b_JaffaCakes118.dll
Size

68KB
MD5

245baada225fc281c0e29fbdd234390b
SHA1

5ed7ecb7307ceaddab05ca5325469f25926a591f
SHA256

434a4f687598897694f8d9bf7a714e87cf26f5c42824060442df102977661e6c
SHA512

669ae1b55004d34a35023e7aecad55f9762146b45df93e3a6ea6533d2fc056b68d4c11143ea857e331853e5b0736a6c14bcb657c192bc534becb2b4fa2d6d135
SSDEEP

1536:vxKNIuYi3uYFg6Dbn36o7sdoCTgzQsoygi1p9tQdZmFER:v6Yi3/5n3H7sdoCTg8soap9Sm+R

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/720-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 720	3436	rundll32.exe	83
PID 3436 wrote to memory of 720	3436	rundll32.exe	83
PID 3436 wrote to memory of 720	3436	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\245baada225fc281c0e29fbdd234390b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\245baada225fc281c0e29fbdd234390b_JaffaCakes118.dll,#1
  2⤵
  PID:720

memory/720-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download