afd307b92dd92ba8b51fa73324b4d4a3d784f3d6d04d3c9414dca70fb4149ecc

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 11:53

Target

3d453d398e9d57565cd04ae2261801f1_JaffaCakes118.dll
Size

58KB
MD5

3d453d398e9d57565cd04ae2261801f1
SHA1

2dcd66f401d263d753ad357e81370197a9919f44
SHA256

afd307b92dd92ba8b51fa73324b4d4a3d784f3d6d04d3c9414dca70fb4149ecc
SHA512

b23f1bc83ffb6717034d1178b99f41ad0e836232ca8fe1d5090ca1a73afff9ff43557d0b41a1660f32c68bdfe7a9102209a7e5a17dd0b488cf562b6b8da3648e
SSDEEP

1536:9mMRXvlVI4xhqR6qovimjcF9upoXy4ow0L+2w440Q4X8:guE4xc6qCimRpoX9Bb4402

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1500-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 1500	2840	rundll32.exe	83
PID 2840 wrote to memory of 1500	2840	rundll32.exe	83
PID 2840 wrote to memory of 1500	2840	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d453d398e9d57565cd04ae2261801f1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d453d398e9d57565cd04ae2261801f1_JaffaCakes118.dll,#1
  2⤵
  PID:1500

memory/1500-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download