80d5d7028b2e0b736f03cc43b347f416f3c65d1576f84a85e5aabb16f52592d8

Analysis

max time kernel
94s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 03:54

Target

33350ca6c12540812d8d9c7d823aa6a4_JaffaCakes118.dll
Size

83KB
MD5

33350ca6c12540812d8d9c7d823aa6a4
SHA1

3486ef7ebac82bcd807dd395d279f47122b3bad1
SHA256

80d5d7028b2e0b736f03cc43b347f416f3c65d1576f84a85e5aabb16f52592d8
SHA512

9e0842ee0e2866775b0aab3dd2126b95ea3c08d812a3d8c9b7dea9973996b2f0acb01b1900ae63e2078dbcbe9d96da0bfab3081bc1e59d38967e5dda7dec0335
SSDEEP

1536:5HpeS2KXh9tDvXtz+Xv9egoLCLVNpxlqrcnwZIMBkeDG6ZE:5D2KXtD/F+gCpXecwZfB1DXZ

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1196-5-0x0000000000B90000-0x0000000000B9E000-memory.dmp	upx
behavioral2/memory/1196-4-0x0000000000B90000-0x0000000000B9E000-memory.dmp	upx
behavioral2/memory/1196-1-0x0000000000B90000-0x0000000000B9E000-memory.dmp	upx
behavioral2/memory/1196-7-0x0000000000B90000-0x0000000000B9E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 1196	3804	rundll32.exe	83
PID 3804 wrote to memory of 1196	3804	rundll32.exe	83
PID 3804 wrote to memory of 1196	3804	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33350ca6c12540812d8d9c7d823aa6a4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33350ca6c12540812d8d9c7d823aa6a4_JaffaCakes118.dll,#1
  2⤵
  PID:1196

memory/1196-0-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download
memory/1196-5-0x0000000000B90000-0x0000000000B9E000-memory.dmp

Filesize
56KB

Download
memory/1196-4-0x0000000000B90000-0x0000000000B9E000-memory.dmp

Filesize
56KB

Download
memory/1196-1-0x0000000000B90000-0x0000000000B9E000-memory.dmp

Filesize
56KB

Download
memory/1196-6-0x0000000000B80000-0x0000000000B86000-memory.dmp

Filesize
24KB

Download
memory/1196-7-0x0000000000B90000-0x0000000000B9E000-memory.dmp

Filesize
56KB

Download