6e589c49167d9aa9b9a39df00416b9a5ef5632beb8e38bc13b90ed01d78a73cd

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 09:38

Target

2fda348e742a9eed3a11e56ffe190318_JaffaCakes118.dll
Size

30KB
MD5

2fda348e742a9eed3a11e56ffe190318
SHA1

756077a32ddf8b846a32abc47d94cea3c7ffd057
SHA256

6e589c49167d9aa9b9a39df00416b9a5ef5632beb8e38bc13b90ed01d78a73cd
SHA512

b56bb7ec21813209ebc20c866a770d3131ce7dbc697a1ab7d67cac9e67b3e9fac9db0161e9d50ca2fc11dcf1ff833cb430fa334703f2e801774cc57bf2551599
SSDEEP

768:lHeW4Ps/KrqAbMTnO7EsRTZDaXbGL65tJicTj2XKY6:teWz/NOtRThSNyK

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4068-0-0x0000000000400000-0x0000000000419000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 4068	2300	rundll32.exe	82
PID 2300 wrote to memory of 4068	2300	rundll32.exe	82
PID 2300 wrote to memory of 4068	2300	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fda348e742a9eed3a11e56ffe190318_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fda348e742a9eed3a11e56ffe190318_JaffaCakes118.dll,#1
  2⤵
  PID:4068

memory/4068-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download