d83e8b8b40510cc440b84fe7280630a3317161de3178197b8c3d105de0acaefa

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 21:13

Target

366755a96666bcf722e43b9a4c46c1c9_JaffaCakes118.dll
Size

31KB
MD5

366755a96666bcf722e43b9a4c46c1c9
SHA1

3f25c137fcba58d064c691d25a2b8ef7c0413057
SHA256

d83e8b8b40510cc440b84fe7280630a3317161de3178197b8c3d105de0acaefa
SHA512

9b5e3741a2a73df012dd836638430832786616d19f055580162600e1930807f4050e1f1a76c8c3d86c0af9013fd7eb314ae53f4ea6249c2c3e1c319ebf083440
SSDEEP

768:G3iTP1EvVQY5zXwf/ZaS4XpVNP5wUWIZKgLjT:s01gVQYBXO/f4ZVNBcMHT

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/848-0-0x0000000010000000-0x0000000010014000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4464 wrote to memory of 848	4464	rundll32.exe	rundll32.exe
PID 4464 wrote to memory of 848	4464	rundll32.exe	rundll32.exe
PID 4464 wrote to memory of 848	4464	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\366755a96666bcf722e43b9a4c46c1c9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4464

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\366755a96666bcf722e43b9a4c46c1c9_JaffaCakes118.dll,#1
2⤵
PID:848

memory/848-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download