7099b2a84a42ba17d7c107acf628da8daf2822fa080d5da282fc1c40d9c8eb47

Analysis

max time kernel
94s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 14:59

Target

2cc8216c0e59f682c59ad8bc9f4d7a35_JaffaCakes118.dll
Size

123KB
MD5

2cc8216c0e59f682c59ad8bc9f4d7a35
SHA1

79ce397bf7bb85bb69fa61853e8ba16f9f865356
SHA256

7099b2a84a42ba17d7c107acf628da8daf2822fa080d5da282fc1c40d9c8eb47
SHA512

923074203748a60b9bf467eb2520a2a161fb3783190628125b2f046791895fb3e5d799af7be6110a352b4d9917af03fc1afa2b3b57f126b71f8edcb7a82774f8
SSDEEP

1536:qk9sQZTJD+QMfmnhBbgA6U7bVJqBR//xEDYUFHtJzrdoHcJ9pSSLTtuQy+Y8awdd:l9L1xm6hpbVcBtmLzzrdmI9EMix4d

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4940-0-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 4940	3380	rundll32.exe	82
PID 3380 wrote to memory of 4940	3380	rundll32.exe	82
PID 3380 wrote to memory of 4940	3380	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cc8216c0e59f682c59ad8bc9f4d7a35_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cc8216c0e59f682c59ad8bc9f4d7a35_JaffaCakes118.dll,#1
  2⤵
  PID:4940

memory/4940-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download