54f5f8571d42ed793b0b18ed12482c28e2e42dcf174f3b4f210a912e6865198d

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2024 01:23

Target

3fa4e2f8ca6749d7a29cf1438c434af2_JaffaCakes118.dll
Size

91KB
MD5

3fa4e2f8ca6749d7a29cf1438c434af2
SHA1

50e0b4a897322f1be1e2430e166b12673062f23b
SHA256

54f5f8571d42ed793b0b18ed12482c28e2e42dcf174f3b4f210a912e6865198d
SHA512

945f36e18a991cdceee58c7469c9227d1d94f7b0f5370f99791b20c4fedf0c4721525a301d33006eac6d31fd89031cc1827064da4b9b2f62a4fa1f16d1abce4d
SSDEEP

1536:IT+BBKiZltebqBScHHQRZbXOQ2k1osC8lizVYYR4Nb:IT+BBhMbqB5HcZzOrSGCiZYYGt

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/400-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 400	2368	rundll32.exe	84
PID 2368 wrote to memory of 400	2368	rundll32.exe	84
PID 2368 wrote to memory of 400	2368	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3fa4e2f8ca6749d7a29cf1438c434af2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3fa4e2f8ca6749d7a29cf1438c434af2_JaffaCakes118.dll,#1
  2⤵
  PID:400

memory/400-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download