e24f31534b2c99886e0f3c353ddfb7225d360367022aa61b79b94dd5cc0781f0

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 14:16

Target

397944d24ad784b1c7ff55d742e4fe68_JaffaCakes118.dll
Size

86KB
MD5

397944d24ad784b1c7ff55d742e4fe68
SHA1

b30969e69ce619928f1471da4d346bcdda888c5b
SHA256

e24f31534b2c99886e0f3c353ddfb7225d360367022aa61b79b94dd5cc0781f0
SHA512

53cea0bb534191437a5f827c73329f43939157e1f9874aedafc342b9504d21e28173fcf0f939edca3f75f7e1a556085dd2794af2494b9679d668cc7c2bb8c2c0
SSDEEP

1536:Xrj2DTisS3kalQmflJBr5+IFqCbrOFHiS6+ns582xInRW:v2DTv1alQm/Br5+eHbrOFH0+s586InRW

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2548-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 2548	4300	rundll32.exe	83
PID 4300 wrote to memory of 2548	4300	rundll32.exe	83
PID 4300 wrote to memory of 2548	4300	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\397944d24ad784b1c7ff55d742e4fe68_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\397944d24ad784b1c7ff55d742e4fe68_JaffaCakes118.dll,#1
  2⤵
  PID:2548

memory/2548-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download