541508503875a9aa694ed1a45045a545113f46163ba22ca70e45116cff2fac58

Analysis

max time kernel
94s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 09:52

Target

281e68b84bd63930d6c4de7f2a406f1c_JaffaCakes118.dll
Size

96KB
MD5

281e68b84bd63930d6c4de7f2a406f1c
SHA1

e64b9f93f7cb89911260dae76ad80c915e588795
SHA256

541508503875a9aa694ed1a45045a545113f46163ba22ca70e45116cff2fac58
SHA512

2bf6ca712855300c646791468e4400ba58136f1c6dc6c6fead645de81b757c62c9cd76aa9e3de854678aee75427b6047bc72845fe788723989faebeb1f9fcd76
SSDEEP

1536:Gtbad8oQmjBhVNiHseMxkZS8/F3aaRutY3YdL9YW0oliVd:maSMBhVNgMISe6YIdLSWob

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2880-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2880	2136	rundll32.exe	82
PID 2136 wrote to memory of 2880	2136	rundll32.exe	82
PID 2136 wrote to memory of 2880	2136	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\281e68b84bd63930d6c4de7f2a406f1c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\281e68b84bd63930d6c4de7f2a406f1c_JaffaCakes118.dll,#1
  2⤵
  PID:2880

memory/2880-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download