b4fcdc55ff536a871110cf00420fcfa313df8715db7f4d7c217a2bf169af1ebf

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 16:50

Target

35916dea658143808d51d1f0d473b22b_JaffaCakes118.dll
Size

79KB
MD5

35916dea658143808d51d1f0d473b22b
SHA1

9c6602fbcf6dd16d3c93f6ee7fac36890ab45139
SHA256

b4fcdc55ff536a871110cf00420fcfa313df8715db7f4d7c217a2bf169af1ebf
SHA512

fbfd795ba262d2ccbc8d584fb796dcdee20756cf1c7d051484303747b9ccddb71968287b00062309af13db03a07124c38ca1fdf9b241d217db4198372df48ae5
SSDEEP

1536:n1P3M7oe6wdFD64eAMtvrs5BcD4FTYYuG+EkTt9kL+t8uF2d:n107D6EDVWvrs5S0iYz+vt9NtQ

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2804-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 2804	4180	rundll32.exe	83
PID 4180 wrote to memory of 2804	4180	rundll32.exe	83
PID 4180 wrote to memory of 2804	4180	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35916dea658143808d51d1f0d473b22b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\35916dea658143808d51d1f0d473b22b_JaffaCakes118.dll,#1
  2⤵
  PID:2804

memory/2804-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download