e9b8b37bace735833f7d527e33b818c2432319e1880d91e9d0bb89fbf082d6fd

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 14:13

Target

30b524c1b4b1d575225945fe69c31490_JaffaCakes118.dll
Size

240KB
MD5

30b524c1b4b1d575225945fe69c31490
SHA1

af732193d87c452327a4793fbc2d429e066e4154
SHA256

e9b8b37bace735833f7d527e33b818c2432319e1880d91e9d0bb89fbf082d6fd
SHA512

fe9231171a996db7875427788f8003c9f361dad8765e9554fc64bfb6bd2d514251e54a8c39b8f2a792533ab04c63bfb146ec9199d1d5793478d8c2dad1433b5c
SSDEEP

6144:uHdGQb22nwENDkfjlREFAf5tVNRHGPshvxI4I9qW/o:S1b2gwak7EFARtVzzp5Yvo

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3276-3-0x0000000010000000-0x00000000100A5000-memory.dmp	upx
behavioral2/memory/3276-2-0x0000000010000000-0x00000000100A5000-memory.dmp	upx
behavioral2/memory/3276-5-0x0000000010000000-0x00000000100A5000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3276	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 3276	3624	rundll32.exe	81
PID 3624 wrote to memory of 3276	3624	rundll32.exe	81
PID 3624 wrote to memory of 3276	3624	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\30b524c1b4b1d575225945fe69c31490_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\30b524c1b4b1d575225945fe69c31490_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3276

memory/3276-0-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download
memory/3276-1-0x00000000016D0000-0x000000000170B000-memory.dmp

Filesize
236KB

Download
memory/3276-3-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download
memory/3276-2-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download
memory/3276-4-0x000000001006C000-0x00000000100A4000-memory.dmp

Filesize
224KB

Download
memory/3276-5-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download