480cb5c544a81e732ce4915c8961480187503633483289fb0f63287718700b04

Analysis

max time kernel
87s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 19:00

Target

3195ede8cfd6ed06cfb71f5ddcf5a1f2_JaffaCakes118.dll
Size

59KB
MD5

3195ede8cfd6ed06cfb71f5ddcf5a1f2
SHA1

c801284e3d098c6a22de8a08c16661468d934051
SHA256

480cb5c544a81e732ce4915c8961480187503633483289fb0f63287718700b04
SHA512

a4d0634dc677d11f181212315dd5cbdf831189b9f505b030495676b89f6d0f509135399b0c469f4ca8ea013cb2a7f9f0b898fa20dce2c57b8a5673d6f9c1b574
SSDEEP

1536:yHZOR7ltjs6nI0NM2SnBIyrohilG2HzyJR:yH0xltjs65M2sBIu3lGU2/

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3528-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 3528	2532	rundll32.exe	82
PID 2532 wrote to memory of 3528	2532	rundll32.exe	82
PID 2532 wrote to memory of 3528	2532	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3195ede8cfd6ed06cfb71f5ddcf5a1f2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3195ede8cfd6ed06cfb71f5ddcf5a1f2_JaffaCakes118.dll,#1
  2⤵
  PID:3528

memory/3528-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download