910a3d18ec82ce760dc76342a7f4155e58af92d5ec6b9e528f73388397d143a1

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 11:33

Target

348c6eaa67ed8f10af9a810c14d3ddca_JaffaCakes118.dll
Size

89KB
MD5

348c6eaa67ed8f10af9a810c14d3ddca
SHA1

ac2eb4ec80e3f5e31fcd2a29a9234eaf43bcad50
SHA256

910a3d18ec82ce760dc76342a7f4155e58af92d5ec6b9e528f73388397d143a1
SHA512

6bea71ebd1fa9ca582861013af68cebe04cec9ccf930888ad8aa3c7e992180827b684da4e708c3a54d914f7ee7681608cb3e5598474988b08149980eb6cffc50
SSDEEP

1536:R76tUtJXi1awacYgJOr20X8i0M+wvf46wQ18WAfmo0tYB6HT:R7XtlLcYgJOak8i0JwvfBwQ1vYv0tYBK

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1288-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 1288	2772	rundll32.exe	83
PID 2772 wrote to memory of 1288	2772	rundll32.exe	83
PID 2772 wrote to memory of 1288	2772	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\348c6eaa67ed8f10af9a810c14d3ddca_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\348c6eaa67ed8f10af9a810c14d3ddca_JaffaCakes118.dll,#1
  2⤵
  PID:1288

memory/1288-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download