7c3ce366a3cb39dcc8fd6f79cb4a6f62034d1dd59538f56f4be4eff6b58a914d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 10:50

Target

38cf1f0b22d62a6ea478e63f5c50f346_JaffaCakes118.dll
Size

90KB
MD5

38cf1f0b22d62a6ea478e63f5c50f346
SHA1

aa2e383cf5b3b3c13a72a2fcd398052616ae4f2d
SHA256

7c3ce366a3cb39dcc8fd6f79cb4a6f62034d1dd59538f56f4be4eff6b58a914d
SHA512

3e3637921ebd337858544d5f843c29bbbb673efe7c84e5a029b6f8d395f848abccee40d0bf68c95150506987b1e615066d93d08240e21e19d956163a1126cad1
SSDEEP

1536:53/5hksBgk16zIUiHD6TEgCOV2EMhq2Y5EsYQ8nWAPynD3EG:53/5Su16zoGbV2lqPF38nWAanDUG

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2696-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 2696	5092	rundll32.exe	83
PID 5092 wrote to memory of 2696	5092	rundll32.exe	83
PID 5092 wrote to memory of 2696	5092	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38cf1f0b22d62a6ea478e63f5c50f346_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38cf1f0b22d62a6ea478e63f5c50f346_JaffaCakes118.dll,#1
  2⤵
  PID:2696

memory/2696-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download