767b4c6f208d41d20745313fb046bbb89c0ce768f3b92b62839607d70208388d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 18:35

Target

3a4a0ccddd91d8c8e310569b24fd3399_JaffaCakes118.dll
Size

69KB
MD5

3a4a0ccddd91d8c8e310569b24fd3399
SHA1

7c711637068e501a2ac36cb6845b03978f31a348
SHA256

767b4c6f208d41d20745313fb046bbb89c0ce768f3b92b62839607d70208388d
SHA512

53b498966cc1ec654adcab827a647388b607b4acd9629e70f46c60c3ffe0b80cdb8e5a82d599b32276ad18a1c59b52f69a9a356e3bf2050467ada1ac13b340ab
SSDEEP

768:9xBtKtqyLUCu5q+WqBiw36VmaEyDdqSPf+Y/e0Z3urisPFZvqUeysMQqLO4ijG8Z:9D5pAq6Jzq0f+Y1sPFMmsP4QwmxwP/rq

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4728-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 4728	2364	rundll32.exe	83
PID 2364 wrote to memory of 4728	2364	rundll32.exe	83
PID 2364 wrote to memory of 4728	2364	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a4a0ccddd91d8c8e310569b24fd3399_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a4a0ccddd91d8c8e310569b24fd3399_JaffaCakes118.dll,#1
  2⤵
  PID:4728

memory/4728-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download