258ba6f7070d0fecc9c3949460b71d7cf874a062e353640dc4d29b243c4ddcdf

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 09:33

Target

2fd5cb7cdda868816d03f1a30a720bfb_JaffaCakes118.dll
Size

52KB
MD5

2fd5cb7cdda868816d03f1a30a720bfb
SHA1

b092f46575060e9a2041b9218856d054ac74353f
SHA256

258ba6f7070d0fecc9c3949460b71d7cf874a062e353640dc4d29b243c4ddcdf
SHA512

c6b26767ade9cec3df49a2be821848334929e3f84c969cc8de8f3869b29c4756863e5684c23f7f68da81de086b66f35716cc6d33bd8e0f19f619ce8558d6a647
SSDEEP

1536:yHZTeUzIUNZK0Yqiiy++1LPknpoEygRByUSnSvumh:yHlerU3Kiy+S8nwBnpmh

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3864-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 3864	4372	rundll32.exe	82
PID 4372 wrote to memory of 3864	4372	rundll32.exe	82
PID 4372 wrote to memory of 3864	4372	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fd5cb7cdda868816d03f1a30a720bfb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fd5cb7cdda868816d03f1a30a720bfb_JaffaCakes118.dll,#1
  2⤵
  PID:3864

memory/3864-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download