16638bfa7bd671c1ad360be93e369f1c5e03ec607ad22150eafc9ce121c74786

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 07:04

Target

27a862587c07af3f3f95406311f2cfab_JaffaCakes118.dll
Size

132KB
MD5

27a862587c07af3f3f95406311f2cfab
SHA1

bdbaddbdc2c5f4968d341ac10fdb315b0df4da6d
SHA256

16638bfa7bd671c1ad360be93e369f1c5e03ec607ad22150eafc9ce121c74786
SHA512

82aebc39761feb02bfa3c1e2753eb243bb8d08a8e61687879b8ad8feb96e39ed5163e10b18aeea58438d1e7d75d34fad0b1ba653771a2ff6a7bd8a10c8c1ed9a
SSDEEP

3072:i8ImUZg+m5Jf7ahP9zRgmicPrudlJ4ZH:ihmUZg+m517IVdim

Score

7^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5028-0-0x0000000001F20000-0x0000000001F2D000-memory.dmp	upx
behavioral2/memory/5028-4-0x0000000001F20000-0x0000000001F2D000-memory.dmp	upx
behavioral2/memory/5028-3-0x0000000001F20000-0x0000000001F2D000-memory.dmp	upx
behavioral2/memory/5028-8-0x0000000001F20000-0x0000000001F2D000-memory.dmp	upx
behavioral2/memory/5028-7-0x0000000001F20000-0x0000000001F2D000-memory.dmp	upx
behavioral2/memory/5028-9-0x0000000001F20000-0x0000000001F2D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 5028	3572	rundll32.exe	82
PID 3572 wrote to memory of 5028	3572	rundll32.exe	82
PID 3572 wrote to memory of 5028	3572	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27a862587c07af3f3f95406311f2cfab_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27a862587c07af3f3f95406311f2cfab_JaffaCakes118.dll,#1
  2⤵
  PID:5028

memory/5028-0-0x0000000001F20000-0x0000000001F2D000-memory.dmp

Filesize
52KB

Download
memory/5028-4-0x0000000001F20000-0x0000000001F2D000-memory.dmp

Filesize
52KB

Download
memory/5028-3-0x0000000001F20000-0x0000000001F2D000-memory.dmp

Filesize
52KB

Download
memory/5028-6-0x0000000001F10000-0x0000000001F16000-memory.dmp

Filesize
24KB

Download
memory/5028-8-0x0000000001F20000-0x0000000001F2D000-memory.dmp

Filesize
52KB

Download
memory/5028-5-0x0000000001F00000-0x0000000001F01000-memory.dmp

Filesize
4KB

Download
memory/5028-7-0x0000000001F20000-0x0000000001F2D000-memory.dmp

Filesize
52KB

Download
memory/5028-9-0x0000000001F20000-0x0000000001F2D000-memory.dmp

Filesize
52KB

Download