30a850f0573522006ff29ba6972e316b8c58ccad96b8da295518906f64254a58

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 13:45

Target

309eeb2402c0d04705a6ef03eb090d94_JaffaCakes118.dll
Size

217KB
MD5

309eeb2402c0d04705a6ef03eb090d94
SHA1

cd6d455f1b8b9b5ea37f1e5f01116ace3df533bf
SHA256

30a850f0573522006ff29ba6972e316b8c58ccad96b8da295518906f64254a58
SHA512

abcea6f1ff9597f8a3c06aaea2fd5c4fa1d991465de25fe10b4c184bc2c950de402db3b62e5fb1affe9d5752c1e1accbafe6f9668cf6bd5a25a2be85c86af795
SSDEEP

384:ogaUwAW/SGoUPWhS3YzXv0ysk3dI1gNi/rKUQYd61fIBC:TwAaSGoUPWo3iv8kNIgY/+Tt

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3772-0-0x0000000010000000-0x0000000010011000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 3772	4192	rundll32.exe	82
PID 4192 wrote to memory of 3772	4192	rundll32.exe	82
PID 4192 wrote to memory of 3772	4192	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\309eeb2402c0d04705a6ef03eb090d94_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\309eeb2402c0d04705a6ef03eb090d94_JaffaCakes118.dll,#1
  2⤵
  PID:3772

memory/3772-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download