810334b1ab32c522aacd0f2313e3c5cead2b4bb66fa1c2f3c7cfe8a73f9a001d

Analysis

max time kernel
94s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 15:24

Target

39af2dc0194618e8e6553570d4139aac_JaffaCakes118.dll
Size

88KB
MD5

39af2dc0194618e8e6553570d4139aac
SHA1

7b682f99016023803c7dac6c7e7b8b2be2ea11b0
SHA256

810334b1ab32c522aacd0f2313e3c5cead2b4bb66fa1c2f3c7cfe8a73f9a001d
SHA512

c980444a658d056b221e4a964e01b4efff34636aad5fc0ac371e08d8fb97fc41f462a18fc3f9c94e684106271449ee3e365e5c4a2209a73c594583ed6f722a64
SSDEEP

1536:J3iyDPFw2bprmjUmq1AnNkc0tyUc/+XFbJ9dq16V:1Tw2bpCK1AnNn0t92+VbDdq16V

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4936-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 4936	4948	rundll32.exe	83
PID 4948 wrote to memory of 4936	4948	rundll32.exe	83
PID 4948 wrote to memory of 4936	4948	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39af2dc0194618e8e6553570d4139aac_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39af2dc0194618e8e6553570d4139aac_JaffaCakes118.dll,#1
  2⤵
  PID:4936

memory/4936-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download