369a7621b687e24d705fce47644628f8348b143064a35f9438dfcdb6c16b7af9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 03:49

Target

40147b611a5a388f68f0aeeed5d9c6ac_JaffaCakes118.dll
Size

72KB
MD5

40147b611a5a388f68f0aeeed5d9c6ac
SHA1

18f30eca28b43c3cdf69cd299e03763642d6702f
SHA256

369a7621b687e24d705fce47644628f8348b143064a35f9438dfcdb6c16b7af9
SHA512

e223873f2659a141f20c51ecb2196eac2dceacf712f5d7838828ef74a5a7d2ec24df6ddc464111e2e0614c5a8715fb4ce6197e50044bcfe2f0794eba4cd9bbdd
SSDEEP

1536:IykzkagCsf/E+e3tbAPer8m+gXfJvrL8f7tUJcyCv8YvJoj:IFzkaF3+mfJv8pUGyCvbxoj

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4856-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 60 wrote to memory of 4856	60	rundll32.exe	83
PID 60 wrote to memory of 4856	60	rundll32.exe	83
PID 60 wrote to memory of 4856	60	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40147b611a5a388f68f0aeeed5d9c6ac_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:60
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40147b611a5a388f68f0aeeed5d9c6ac_JaffaCakes118.dll,#1
  2⤵
  PID:4856

memory/4856-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download