4252df22d69349268f4ca523376204e19812a9d86ab3e2454d275e08d1f9ac40

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 07:22

Target

2b7333fad58fc7b885a61085f6591cd7_JaffaCakes118.dll
Size

107KB
MD5

2b7333fad58fc7b885a61085f6591cd7
SHA1

26c8c2068eacf49807c8e703ccf768499f4b2176
SHA256

4252df22d69349268f4ca523376204e19812a9d86ab3e2454d275e08d1f9ac40
SHA512

2b2ecf7379ac3fa1b0f2e631bd36b2f5a30ca8cdc68793db3812d7514ba889c975699901aec0e0e66b5000bcd467112e484f1be1239ea4a897c867e0e5f8d915
SSDEEP

3072:uDW+plsUwoLUhtFKKUUuOBvHh3xdKap1qqCk/:uDW+pyU34MKvu+vHZxwkqXk/

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3560-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 3560	1724	rundll32.exe	82
PID 1724 wrote to memory of 3560	1724	rundll32.exe	82
PID 1724 wrote to memory of 3560	1724	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b7333fad58fc7b885a61085f6591cd7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b7333fad58fc7b885a61085f6591cd7_JaffaCakes118.dll,#1
  2⤵
  PID:3560

memory/3560-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download