9775baccfa4ebd99dc2681e77438bfd9eb1542b65b741603ff84da4af54eae7b

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06-07-2024 08:56

Target

27f94077de7b68f59d994d353fc4b1fd_JaffaCakes118.dll
Size

247KB
MD5

27f94077de7b68f59d994d353fc4b1fd
SHA1

dadb9fd1cf123388c94cf4636d6ed5e756a7e348
SHA256

9775baccfa4ebd99dc2681e77438bfd9eb1542b65b741603ff84da4af54eae7b
SHA512

dc4028461195731bc6afc60c15a8ae54683ed7d0f1c60734f3a888e369117fbb24a21674ecef226252dc14de14065eb192a6534b41a2093fd79372df423753e5
SSDEEP

6144:BkNG+NdkuFGXBYV3APFkvCN6J+zUwvWgxUH:BkDNd3GXBi3UFkvfJ+4+TE

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4492-3-0x0000000010000000-0x00000000100A4000-memory.dmp	upx
behavioral2/memory/4492-2-0x0000000010000000-0x00000000100A4000-memory.dmp	upx
behavioral2/memory/4492-5-0x0000000010000000-0x00000000100A4000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4492	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 4492	4320	rundll32.exe	82
PID 4320 wrote to memory of 4492	4320	rundll32.exe	82
PID 4320 wrote to memory of 4492	4320	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27f94077de7b68f59d994d353fc4b1fd_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27f94077de7b68f59d994d353fc4b1fd_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4492

memory/4492-1-0x0000000002A90000-0x0000000002ACC000-memory.dmp

Filesize
240KB

Download
memory/4492-0-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/4492-3-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/4492-2-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/4492-4-0x000000001006C000-0x00000000100A3000-memory.dmp

Filesize
220KB

Download
memory/4492-5-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download