239620e4f9b38f16e9d3736c55f640847c33b5e0d1160f467bd635a5b151133e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 07:35

Target

2f7c4a37e4356321ea831450b9df4a26_JaffaCakes118.dll
Size

57KB
MD5

2f7c4a37e4356321ea831450b9df4a26
SHA1

0e673b3b5e1f7fce86d9a73bb7389e9d6af97bb6
SHA256

239620e4f9b38f16e9d3736c55f640847c33b5e0d1160f467bd635a5b151133e
SHA512

a6bf217ab442bd48903d78ed30903981881d0b4e045332d56abfb7295c3c5c156dc6ceb9ae6d2b4ec0cdfbf42a9f7130ac5f3d543a44a5433045dd201fcd2315
SSDEEP

768:nbY4lGyMPMDnr05GOOsvQ/wyDvLGBrBFN7BhRJWjyjExM1Qc8rob8lPSkcAw6:EGNGInrAhOgabDvqBzhLmvcNJ8

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4452-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 4452	4348	rundll32.exe	82
PID 4348 wrote to memory of 4452	4348	rundll32.exe	82
PID 4348 wrote to memory of 4452	4348	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f7c4a37e4356321ea831450b9df4a26_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f7c4a37e4356321ea831450b9df4a26_JaffaCakes118.dll,#1
  2⤵
  PID:4452

memory/4452-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download