b7bf4c5683e3ef0a45f144eee4b7eb178c878acf0cae802cc9e05716f6987cdf

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 02:24

Target

375924fa11bde337f621d1c09b0340a7_JaffaCakes118.dll
Size

63KB
MD5

375924fa11bde337f621d1c09b0340a7
SHA1

19087eb26436f2d3da5314d650f6b72bfac2a097
SHA256

b7bf4c5683e3ef0a45f144eee4b7eb178c878acf0cae802cc9e05716f6987cdf
SHA512

ac7177a40fe74260e79a4bb06fbbda18b78f2e604b29acd6339a60adb46e01be866aa3a0e39a5f1d173f918bde134dee6d1610a8152ba026b8fa30ffd269ccba
SSDEEP

768:h8WTpVT0X8zbps5HDpsL5Kq+zhOmVboVNVSXzv329w0nVU6iLl5HE093scXSPnTX:RVGHjNn0WSlU6iLPB8sS+pGJdnSO

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2176-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 2176	3712	rundll32.exe	83
PID 3712 wrote to memory of 2176	3712	rundll32.exe	83
PID 3712 wrote to memory of 2176	3712	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\375924fa11bde337f621d1c09b0340a7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\375924fa11bde337f621d1c09b0340a7_JaffaCakes118.dll,#1
  2⤵
  PID:2176

memory/2176-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download