4051a2fe420b5dfd48bf016df9cf0b8f078083ff3a667f8409c9360b0d86dd09

Analysis

max time kernel
94s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 12:12

Target

39108cbb6a1790ddad8524921df361db_JaffaCakes118.dll
Size

61KB
MD5

39108cbb6a1790ddad8524921df361db
SHA1

c589ce901d4b361ccc7022a93eab1d49bfeb645c
SHA256

4051a2fe420b5dfd48bf016df9cf0b8f078083ff3a667f8409c9360b0d86dd09
SHA512

1d3b2e2eac0fdd0376a81edfd3c694cfeddb57daf87d83b1c01f0baba8a513351bcef8cfc7f0a535d19bf3696a0a6d1fa630292f89a3cfebcd3a246dbda7b328
SSDEEP

1536:GtfMOSJ/Yzbr0DMr+BH20dqQdF+DDh58u8:GSOS5Yg120dqYF+DDh5H8

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1844-0-0x0000000010000000-0x000000001002C000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1844	rundll32.exe
1844	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 1844	3948	rundll32.exe	83
PID 3948 wrote to memory of 1844	3948	rundll32.exe	83
PID 3948 wrote to memory of 1844	3948	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39108cbb6a1790ddad8524921df361db_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39108cbb6a1790ddad8524921df361db_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1844

memory/1844-0-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download