ed92f50e63da06ba1cb705afd1117f6c25bccadbfdc203ecf733e3f33cb52d68

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 11:43

Target

2c35b1c1fe5de16ca56aa1895b9f9cb0_JaffaCakes118.dll
Size

102KB
MD5

2c35b1c1fe5de16ca56aa1895b9f9cb0
SHA1

ea1f5136b900c6f73eb1a7f5f0ff9af549f84aec
SHA256

ed92f50e63da06ba1cb705afd1117f6c25bccadbfdc203ecf733e3f33cb52d68
SHA512

a73b55aecdc3374c6240b20b0669e7d883e4bbfaafbd2de624ecb47aafdf033fc04f5f4b03c00cca4c5e8ef3b17812bdcb22f20fd9cc48f0dfae5b7a1651766b
SSDEEP

3072:7RCVcAHzYRjDfgVYIzfoHOJFykZdHUSVVaRKeR8W:7syzR/8eOekbHPURQW

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4684-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 4684	3296	rundll32.exe	82
PID 3296 wrote to memory of 4684	3296	rundll32.exe	82
PID 3296 wrote to memory of 4684	3296	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c35b1c1fe5de16ca56aa1895b9f9cb0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c35b1c1fe5de16ca56aa1895b9f9cb0_JaffaCakes118.dll,#1
  2⤵
  PID:4684

memory/4684-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download