17fdb618f7c8fe5b6a870f9195e29781500d2484d792ee910e2ab2ef51f47ca0

Analysis

max time kernel
92s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 00:02

Target

26ba52779e1dca46e203efa67078912e_JaffaCakes118.dll
Size

15KB
MD5

26ba52779e1dca46e203efa67078912e
SHA1

0a5c16d3786a651d3d7401af8ba9a4dd0e637da0
SHA256

17fdb618f7c8fe5b6a870f9195e29781500d2484d792ee910e2ab2ef51f47ca0
SHA512

964bf4f68276f704932388d0d699b1271f306f8d1a0f639cd34b9212e9d1a06c5f1459b8c5eb125c6b5be4b5befcd91bb9c94fd6a23d211f6315953f7758daeb
SSDEEP

384:jJQvQzW6sFuvger5H5G4eCuPaD9OZejy+0MdA:j6Yy6oYCqeqoO0Me

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5048-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5048	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5048	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5048	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 5048	3884	rundll32.exe	81
PID 3884 wrote to memory of 5048	3884	rundll32.exe	81
PID 3884 wrote to memory of 5048	3884	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26ba52779e1dca46e203efa67078912e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\26ba52779e1dca46e203efa67078912e_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5048

memory/5048-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download