f5303df851c23a93d1f912158c14954bb6bff7823a60c130927a0c714fa5ebb8

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 18:09

Target

25bcba571a3ac61a63c0786c90b03e2e_JaffaCakes118.dll
Size

7KB
MD5

25bcba571a3ac61a63c0786c90b03e2e
SHA1

3987669a8630e11210d4b100181ded41b080903b
SHA256

f5303df851c23a93d1f912158c14954bb6bff7823a60c130927a0c714fa5ebb8
SHA512

f80ab4e4f7a1458d66736e670367ccc6c0fb0ab8a63cb634d74956ae004cb2943ba2c5efde4745f4fe9b6ba82d70c3defa2dfc81b819577e7b791c5042a403e3
SSDEEP

96:nPc44LoNUpyilulNTKvm3pY99C+hp4WRN2o8MTMP345QT3BL5aQts:n3FsslNTKv2pqBcWsMT84+tI

Score

7^/10

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/4532-0-0x0000000000400000-0x000000000040A000-memory.dmp	acprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 4532	4016	rundll32.exe	83
PID 4016 wrote to memory of 4532	4016	rundll32.exe	83
PID 4016 wrote to memory of 4532	4016	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25bcba571a3ac61a63c0786c90b03e2e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\25bcba571a3ac61a63c0786c90b03e2e_JaffaCakes118.dll,#1
  2⤵
  PID:4532

memory/4532-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download