7c97734988b98e9135c045a1e8c03d7e4ca7bb4fbc1cb8ab00a4a116eb05d8d1

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 22:25

Target

43953c2b85cf6937c5bc1d5e06635efe_JaffaCakes118.dll
Size

85KB
MD5

43953c2b85cf6937c5bc1d5e06635efe
SHA1

ee7780df25d8f5f0527d2e20d07f83058b545a3b
SHA256

7c97734988b98e9135c045a1e8c03d7e4ca7bb4fbc1cb8ab00a4a116eb05d8d1
SHA512

cedec80e63bf5152cf65060da08cb95306d6421a172e7ad103b64c717c60c74fcda4e189b40127be1ef215ad8e43fc94c71adf341a788aa1ec269ddd8948beb7
SSDEEP

1536:nw0yKsoJxGqtBehZQywvoUvCG5om1skUjbCS1FQlhzEomL:RHJXBAQyg5okbyV1uvrU

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1444-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 1444	4916	rundll32.exe	83
PID 4916 wrote to memory of 1444	4916	rundll32.exe	83
PID 4916 wrote to memory of 1444	4916	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43953c2b85cf6937c5bc1d5e06635efe_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\43953c2b85cf6937c5bc1d5e06635efe_JaffaCakes118.dll,#1
  2⤵
  PID:1444

memory/1444-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download