a4957602d73f7ca4843d701290c36becd7ccdc2e263059c6e4b643d1c7582907

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 17:42

Target

3e46bef8bd8d8abbee3099530adfa950_JaffaCakes118.dll
Size

68KB
MD5

3e46bef8bd8d8abbee3099530adfa950
SHA1

1c09795540bd812093d2b8b75f24ddba0fc8c0dc
SHA256

a4957602d73f7ca4843d701290c36becd7ccdc2e263059c6e4b643d1c7582907
SHA512

3bd7d5be72a1f79630389f3fc27275d8024d5205246f05fdfeceb28e8a4852778f2b523b445ca47ba1a7bf96d9c15b3e863f47299831035d6da116cf3f90c75b
SSDEEP

1536:0UIsMWwFBE8P3WhH4EMFTCDktnCJiFXoJOHGsEjD56Zjz/Z8:55DwFC8DEMNCDwn44XoJuGsEny3/u

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4748-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 4748	4508	rundll32.exe	83
PID 4508 wrote to memory of 4748	4508	rundll32.exe	83
PID 4508 wrote to memory of 4748	4508	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e46bef8bd8d8abbee3099530adfa950_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e46bef8bd8d8abbee3099530adfa950_JaffaCakes118.dll,#1
  2⤵
  PID:4748

memory/4748-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download