ba93eba5e6e01e4b2e18c0fbb5a6a40b54beb9a3015c7e730546112dbf1b2016

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 05:56

Target

24dbe95679c3d07a9640914e106d2252_JaffaCakes118.dll
Size

73KB
MD5

24dbe95679c3d07a9640914e106d2252
SHA1

c468c0be18855981ffd6f4a3c22cb965ad8c579b
SHA256

ba93eba5e6e01e4b2e18c0fbb5a6a40b54beb9a3015c7e730546112dbf1b2016
SHA512

04efc6a6758d5e261355a71757af42d78a0363e2aa74f4e9265a04ec49db5cf491eee2c431edd276c10121c5fc79cb4208a42b971e0f0b519091003a09ef6e93
SSDEEP

1536:5jRmOCW8lNJKj4y0p5RGamQQ3mHNzrR8OgkL65J31EtX:xf4s4y0pWaNQ3mHoF1Ed

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1772-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 1772	4652	rundll32.exe	83
PID 4652 wrote to memory of 1772	4652	rundll32.exe	83
PID 4652 wrote to memory of 1772	4652	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24dbe95679c3d07a9640914e106d2252_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24dbe95679c3d07a9640914e106d2252_JaffaCakes118.dll,#1
  2⤵
  PID:1772

memory/1772-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download