778df44dc955701fe23c1e4e6e817d3a133825554aeb75867b0e3cfb333975bf

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 03:44

Target

4010109ce01cfa5743e1163b4824daaf_JaffaCakes118.dll
Size

14KB
MD5

4010109ce01cfa5743e1163b4824daaf
SHA1

ccea95f38d3e8579ce559e04287d48db34585254
SHA256

778df44dc955701fe23c1e4e6e817d3a133825554aeb75867b0e3cfb333975bf
SHA512

5be4c10b06df319302aa7d41ff5323f7b0ff931ac1a4c4461eaf099ab9772246f1b07fa1374c7cb0f86f9a5ede08cce380b9e2a14473e5312f4f9bd6bb4fbd03
SSDEEP

192:nr3dB4qa9Ub4+f4n+72jk+xQmiojpD0tKkGQeu6YCUVksVEa2/UkF16W8mcWtArF:H4qmMXg+2eoju2Qe4d2skr6W8mcWG

Score

8^/10

upx

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	regsvr32.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/416-0-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 416	2136	regsvr32.exe	83
PID 2136 wrote to memory of 416	2136	regsvr32.exe	83
PID 2136 wrote to memory of 416	2136	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4010109ce01cfa5743e1163b4824daaf_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4010109ce01cfa5743e1163b4824daaf_JaffaCakes118.dll
  2⤵
  - Drops file in Drivers directory
  PID:416

memory/416-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download