2dbf9bbb854f40d4deb45cf83c95e38597fbce951f86be9e2ad22a75951f9a29

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 04:49

Target

24ae59d8f93571f7305d819d800b9c7c_JaffaCakes118.dll
Size

265KB
MD5

24ae59d8f93571f7305d819d800b9c7c
SHA1

76b5065aca025b5fd24aee2f70432bbf8c751370
SHA256

2dbf9bbb854f40d4deb45cf83c95e38597fbce951f86be9e2ad22a75951f9a29
SHA512

1e3b39a377e04d1ee323d7d13eb367a4f882dd92312d1c862aaee6d7af362a324525a95a4990508c8c096fcbc50aa4791e487f1183f1c8932a99dfa9e0e9ea5f
SSDEEP

6144:rszrIP3acuC5Cydti9Pet80gUTpVNBMVM4l4SzPiYK:4zcPTuCYZ9zDUpVNBMVM4piYK

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/372-2-0x0000000010000000-0x00000000100AE000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
372	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 372	4532	rundll32.exe	81
PID 4532 wrote to memory of 372	4532	rundll32.exe	81
PID 4532 wrote to memory of 372	4532	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24ae59d8f93571f7305d819d800b9c7c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24ae59d8f93571f7305d819d800b9c7c_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:372

memory/372-0-0x0000000010002000-0x0000000010004000-memory.dmp

Filesize
8KB

Download
memory/372-1-0x0000000010000000-0x00000000100AE000-memory.dmp

Filesize
696KB

Download
memory/372-2-0x0000000010000000-0x00000000100AE000-memory.dmp

Filesize
696KB

Download