2368b23e5055c448d1c0addf9acbe3b251d0e1fe6a5dc40f08807f23a377bca2

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 10:06

Target

38ae57278053a270979357f5c9e5019b_JaffaCakes118.dll
Size

55KB
MD5

38ae57278053a270979357f5c9e5019b
SHA1

03fb174532c05ef37c9e40e9030239a1763fed48
SHA256

2368b23e5055c448d1c0addf9acbe3b251d0e1fe6a5dc40f08807f23a377bca2
SHA512

71b9bf4798e7e4a1d5fedc7e6707d6231480587470c5af6495f798233818a85a4c5de69db294a2f9f589aa6715760de31bbb41336eca42cdc31a246b19524499
SSDEEP

768:OhBbrk2YXYADCbi/caPmC3ylQJ0DM+ZsmkrsAARgLsSiUn3EOLvu62Zi0oICbOpN:sBfn+dDCW/whDLs75sBU08ai0oICKb

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4136-0-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 4136	396	rundll32.exe	84
PID 396 wrote to memory of 4136	396	rundll32.exe	84
PID 396 wrote to memory of 4136	396	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38ae57278053a270979357f5c9e5019b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38ae57278053a270979357f5c9e5019b_JaffaCakes118.dll,#1
  2⤵
  PID:4136

memory/4136-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download