161b1cf750dcc25526c69ae027a48cc214c37fd9ee096ac382e1f8636490dff1

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 11:31

Target

2c2bb489b6982658d79d6e398826edf0_JaffaCakes118.dll
Size

69KB
MD5

2c2bb489b6982658d79d6e398826edf0
SHA1

ff322834e03feb597c213573085626b9fe4c3ecd
SHA256

161b1cf750dcc25526c69ae027a48cc214c37fd9ee096ac382e1f8636490dff1
SHA512

0c8501be2d2f2bc113bf10843c220ac5285e62d7e14c1fb6a43e2fdc0c3bed7daf67df86bd4f53e55aa7533b9cdd1b6d7d68b94d33fbe02eec9677b26deeb5a5
SSDEEP

1536:EGUwftANLCvLcosjG8WYWYLlcMqeqt4Qxp79g:EGLlANujcosq8bLl5lqt4KlC

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4488-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 4488	1964	rundll32.exe	82
PID 1964 wrote to memory of 4488	1964	rundll32.exe	82
PID 1964 wrote to memory of 4488	1964	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c2bb489b6982658d79d6e398826edf0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c2bb489b6982658d79d6e398826edf0_JaffaCakes118.dll,#1
  2⤵
  PID:4488

memory/4488-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download