c8af5be409247c5289be342cc461d7b55745251c1ec292570fc54929e492202a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 08:45

Target

2551cb1b41728162c9492ca0dde3e59d_JaffaCakes118.dll
Size

61KB
MD5

2551cb1b41728162c9492ca0dde3e59d
SHA1

b6f0c80efb971353a8de20358eae9e1aa1d10728
SHA256

c8af5be409247c5289be342cc461d7b55745251c1ec292570fc54929e492202a
SHA512

4748f9c5f47e4b8c7c09fda1b910e0cac80bf3e2f0b48eb07e4b43d507ae6e8e9741604225952de452c8e0d36fefa17a72fab4588f4e4259a3832a9881357a9b
SSDEEP

1536:4XkTnJx7bXAwfRKztF1C3qMHaupAoVRpp568x1TW:SKJxfAcKB/C3ZHlpAApprC

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4552-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 4552	3200	rundll32.exe	80
PID 3200 wrote to memory of 4552	3200	rundll32.exe	80
PID 3200 wrote to memory of 4552	3200	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2551cb1b41728162c9492ca0dde3e59d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2551cb1b41728162c9492ca0dde3e59d_JaffaCakes118.dll,#1
  2⤵
  PID:4552

memory/4552-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download