83c71dc1e7fcaced11a96d7867e7cf123067b3f1d1419d05062da0b94ce26737

Analysis

max time kernel
93s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 00:10

Target

26c144664a5720fc9b10834f92893f56_JaffaCakes118.dll
Size

232KB
MD5

26c144664a5720fc9b10834f92893f56
SHA1

3dfb997f81cbca705a7699635a519955f0c5584d
SHA256

83c71dc1e7fcaced11a96d7867e7cf123067b3f1d1419d05062da0b94ce26737
SHA512

3c0e8117c39a5d0b8723915700617cd90408269c8d9976b37c9ddc6e8d2a7ae42f138798669400b22843b17138bcca5650c7311a5651f04b6fe38709b9fb2f8e
SSDEEP

6144:7nrLAX3ot4ectdRHycTFp+UsjkrW3hq/UXa6UYjCgplaEDF:nLO3ot4e2PHXrsIrAo/UjUfMl7DF

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2776-0-0x0000000010000000-0x00000000100A8000-memory.dmp	upx
behavioral2/memory/2776-1-0x0000000010000000-0x00000000100A8000-memory.dmp	upx
behavioral2/memory/2776-5-0x0000000010000000-0x00000000100A8000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2776	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2776	1744	rundll32.exe	80
PID 1744 wrote to memory of 2776	1744	rundll32.exe	80
PID 1744 wrote to memory of 2776	1744	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26c144664a5720fc9b10834f92893f56_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\26c144664a5720fc9b10834f92893f56_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2776

memory/2776-0-0x0000000010000000-0x00000000100A8000-memory.dmp

Filesize
672KB

Download
memory/2776-1-0x0000000010000000-0x00000000100A8000-memory.dmp

Filesize
672KB

Download
memory/2776-3-0x0000000001140000-0x0000000001178000-memory.dmp

Filesize
224KB

Download
memory/2776-2-0x0000000010000000-0x00000000100A8000-memory.dmp

Filesize
672KB

Download
memory/2776-4-0x000000001006F000-0x00000000100A5000-memory.dmp

Filesize
216KB

Download
memory/2776-5-0x0000000010000000-0x00000000100A8000-memory.dmp

Filesize
672KB

Download