bc1e407883a122172a7409ca356ebb618d72fc010793a17bb284525a0f807e2a

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 13:17

Target

3d87e87cf40ab825afc0ee7f27e04d2d_JaffaCakes118.dll
Size

58KB
MD5

3d87e87cf40ab825afc0ee7f27e04d2d
SHA1

fe7afdc1d41fab6a874d687d49111d8d3112c229
SHA256

bc1e407883a122172a7409ca356ebb618d72fc010793a17bb284525a0f807e2a
SHA512

b71c6ac9eb16f21581ec8f755dd95fabb6a1044c3390d54256de58b31a8aa5dbed8e5ab3faa8ecaccd086688ba9944d1790bb45ce0ae630aae33e347dd7f7f69
SSDEEP

768:z3OHS8KOzJ6LxFvUELkDAaVtPFM/wRhhR+0Admd8X17f7WQqcjp7aIMzxtgY/pxQ:yHZt6lK2gN1nDR+xdmzvK7yplJe

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4512-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 4512	3436	rundll32.exe	83
PID 3436 wrote to memory of 4512	3436	rundll32.exe	83
PID 3436 wrote to memory of 4512	3436	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d87e87cf40ab825afc0ee7f27e04d2d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d87e87cf40ab825afc0ee7f27e04d2d_JaffaCakes118.dll,#1
  2⤵
  PID:4512

memory/4512-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download