211ab1ea46165479af1f6756011773d02a5195fb0b70296b8866a32e3a2c7335

Analysis

max time kernel
91s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 03:31

Target

2ad65a7f4f8d5147fa3972a16fb11299_JaffaCakes118.dll
Size

139KB
MD5

2ad65a7f4f8d5147fa3972a16fb11299
SHA1

d3b47e35e41a86cf18123b8c75c567e309fbe05f
SHA256

211ab1ea46165479af1f6756011773d02a5195fb0b70296b8866a32e3a2c7335
SHA512

a73586e040fc6151c7362b56dcf3c9ebee319d3e4657e18674041fca1583655acfc8d3c95530ef6a94cc14ff7e6149d2e8fbda334f6d0f5cbb4388212c69f33e
SSDEEP

1536:1cwwwHj95OW6Jrido/ksKRmKae+XELdrYK4tXqB5j/Zh/icNH9xW:1ZbOW6L8lae+Upry5qHDZh/icNdk

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4252-0-0x0000000010000000-0x0000000010017000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 4252	3980	rundll32.exe	82
PID 3980 wrote to memory of 4252	3980	rundll32.exe	82
PID 3980 wrote to memory of 4252	3980	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ad65a7f4f8d5147fa3972a16fb11299_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ad65a7f4f8d5147fa3972a16fb11299_JaffaCakes118.dll,#1
  2⤵
  PID:4252

memory/4252-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download