6e3d3a14978cf463f86b61b9ef9775a85e7f05788875ac8f0d340456c22ab248

Analysis

max time kernel
124s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 22:32

Target

2e0ff6eb919c6c03b938275834c2c224_JaffaCakes118.dll
Size

19KB
MD5

2e0ff6eb919c6c03b938275834c2c224
SHA1

baee8f3a4433b54fc4c5d583ea74edac8ff76fd9
SHA256

6e3d3a14978cf463f86b61b9ef9775a85e7f05788875ac8f0d340456c22ab248
SHA512

cc531271c626ab5b2b00e4392fdff08da5d3a401d6ce98c3c1f4960ed34649168a26972fd3a214ae4d61e09622aa17fd94aa4b51101aad040c81b063adec9713
SSDEEP

384:n5WfBssBK1QBiNCTDJJuS8fYH/Q3XLLFUur9AOs/9:5WfBPIQAMnJJ/8fS/kfFfpu9

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4280-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 22 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 4280	2968	rundll32.exe	89
PID 2968 wrote to memory of 4280	2968	rundll32.exe	89
PID 2968 wrote to memory of 4280	2968	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e0ff6eb919c6c03b938275834c2c224_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e0ff6eb919c6c03b938275834c2c224_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3856,i,17705702031385645742,8200011525621908985,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:8
1⤵
PID:1644

memory/4280-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download