3e694a3a2fc8e390e1ad61841e1be46fc1836d57a789325c678a3918f33fbf56

Analysis

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 11:34

Target

2c2eb765a7c829bf908e56814daad80e_JaffaCakes118.dll
Size

243KB
MD5

2c2eb765a7c829bf908e56814daad80e
SHA1

ea99f5c4abe5a1ee4767a699532159c6e8eb5214
SHA256

3e694a3a2fc8e390e1ad61841e1be46fc1836d57a789325c678a3918f33fbf56
SHA512

9c35653a8e6989dea5b9a01072bf1bf8f506bff68d82257f47b33a5554a211650cfdefb3fd0fcd227b2798584db35b5f544d5d397074d5ff12e854b886ab23a1
SSDEEP

6144:0xBZku30ZV7g+EBZCwXR4cUYOqy0hWOHbH9xru1YyDyJdr6E:ukuGlwXR9jOqyEWOHbH9duCyyrL

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4348-2-0x0000000010000000-0x00000000100A5000-memory.dmp	upx
behavioral2/memory/4348-3-0x0000000010000000-0x00000000100A5000-memory.dmp	upx
behavioral2/memory/4348-5-0x0000000010000000-0x00000000100A5000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4348	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 4348	1140	rundll32.exe	82
PID 1140 wrote to memory of 4348	1140	rundll32.exe	82
PID 1140 wrote to memory of 4348	1140	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c2eb765a7c829bf908e56814daad80e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c2eb765a7c829bf908e56814daad80e_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4348

memory/4348-0-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download
memory/4348-1-0x0000000002490000-0x00000000024CB000-memory.dmp

Filesize
236KB

Download
memory/4348-2-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download
memory/4348-3-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download
memory/4348-4-0x000000001006C000-0x00000000100A4000-memory.dmp

Filesize
224KB

Download
memory/4348-5-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download