15d61ba8b12bca41901cfd58fc4ed516bd12c398c9860683c5e9c33478e66177

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 00:58

Target

3b67edd82667455e8222cc6c26a84e46_JaffaCakes118.dll
Size

47KB
MD5

3b67edd82667455e8222cc6c26a84e46
SHA1

1e302132c3eb35e223b5e3aebff294767f4490fa
SHA256

15d61ba8b12bca41901cfd58fc4ed516bd12c398c9860683c5e9c33478e66177
SHA512

4c18681ef8155cbe5e6aa64e2eca889c1b65ef017e64a2ac9d4467e5142cf5dad5afc565c8cb512fd168a16a5119e7ee9f4ecdd0fa99929dfda2cc6888071722
SSDEEP

768:h8WTpVT0X8zbDwrqzidGQGnOapTddyBrrqQpt61qd87vnaDOt4Lbf/dLCm7t1t5T:RVPwrinOMiBrQj7vf4Lbf1LCoOi

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1908-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1908	2000	rundll32.exe	83
PID 2000 wrote to memory of 1908	2000	rundll32.exe	83
PID 2000 wrote to memory of 1908	2000	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b67edd82667455e8222cc6c26a84e46_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b67edd82667455e8222cc6c26a84e46_JaffaCakes118.dll,#1
  2⤵
  PID:1908

memory/1908-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download