8509ec4fc6f20acce660a1f5684e54fee3e0b41502648a06a41d60767bcf181a

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 00:44

Target

3710c5892ee32991ea06ccb691896f8b_JaffaCakes118.dll
Size

98KB
MD5

3710c5892ee32991ea06ccb691896f8b
SHA1

c13f0ce3533034c43b3258dece3a9818b8cfc301
SHA256

8509ec4fc6f20acce660a1f5684e54fee3e0b41502648a06a41d60767bcf181a
SHA512

0f32ec768116fc609d0e93f74ed1f8c50835de46720613eafe2204fea7934886ed2868fa2c55f8bd2a83f6a77aad1a0432973295d87a04f20e5c418ad5b22ee0
SSDEEP

1536:Zn4Mi33LS7enDxB4eJO26Mgz12hhrLRwbf0uzdZzPp3cvEjJ3fIlnq:Zfi3b8enD34+O9MAQhJCIgd5mqJ3onq

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4076-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 4076	2012	rundll32.exe	83
PID 2012 wrote to memory of 4076	2012	rundll32.exe	83
PID 2012 wrote to memory of 4076	2012	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3710c5892ee32991ea06ccb691896f8b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3710c5892ee32991ea06ccb691896f8b_JaffaCakes118.dll,#1
  2⤵
  PID:4076

memory/4076-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download