faeeaead7a08444c696c21825c1a93042f2cd7b8e83125198a85ca22183d0e02

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 02:41

Target

2ab3dfc59fe7e8cc382a12499dc48d98_JaffaCakes118.dll
Size

62KB
MD5

2ab3dfc59fe7e8cc382a12499dc48d98
SHA1

a167628ae8b5c20abc67e9fe1620e46926ce4130
SHA256

faeeaead7a08444c696c21825c1a93042f2cd7b8e83125198a85ca22183d0e02
SHA512

9948e5f9d8cb1e71243102334468f3a567537722c7bd10dc694a1cf8e487bc0dbed8409a29c1d2d9609a47e3be6af89c8dc6f9e2592d7e1b35e7ead05fa5c3cb
SSDEEP

1536:90gYxJs6md2GQQ/XufcLDHlgQIcaX2nJ4ifWT5J40C65r:rYAvdJvXuZQIchWl9

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1600-0-0x0000000010000000-0x0000000010011000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1600	2444	rundll32.exe	82
PID 2444 wrote to memory of 1600	2444	rundll32.exe	82
PID 2444 wrote to memory of 1600	2444	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ab3dfc59fe7e8cc382a12499dc48d98_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ab3dfc59fe7e8cc382a12499dc48d98_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1600

memory/1600-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download