8df7764602b55a0950373c9359d2dc1007191ba21419e078c0b193f86f95e740

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 20:45

Target

3aa76a33600b96fe1ceb576331460280_JaffaCakes118.dll
Size

31KB
MD5

3aa76a33600b96fe1ceb576331460280
SHA1

4f7f99fbffbf027155516d42d35f68d87b198855
SHA256

8df7764602b55a0950373c9359d2dc1007191ba21419e078c0b193f86f95e740
SHA512

6eb33ff55628f94a2f090654204a76afa6e4cb923e1d1bcab6365089b66d91f94c51931371ef41e18b275e29aeb24316d20ea72cd71b2dddb5889c203ce2032c
SSDEEP

768:8BW/CuJ+LbjM+QmdbHc37RdHUKy4m376:8BUYfM+Qmdjc9f7q76

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/680-0-0x0000000010000000-0x000000001001B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 680	3448	regsvr32.exe	83
PID 3448 wrote to memory of 680	3448	regsvr32.exe	83
PID 3448 wrote to memory of 680	3448	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3aa76a33600b96fe1ceb576331460280_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3aa76a33600b96fe1ceb576331460280_JaffaCakes118.dll
  2⤵
  PID:680

memory/680-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download