0b214657b42f8350d26ef635c7e85415c90b18a98df9af409915ac16ff4da88b

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2024 04:50

Target

40446f3e59533c0acc678ee0011789b3_JaffaCakes118.dll
Size

231KB
MD5

40446f3e59533c0acc678ee0011789b3
SHA1

6c2a0da274380897000947d46f91f77d1092868e
SHA256

0b214657b42f8350d26ef635c7e85415c90b18a98df9af409915ac16ff4da88b
SHA512

cdc64bd655af327fae4493b07afd256fe9cb3f873924f476d194c20dbe694cca12da55fe61396b9af183857e1fbfe51486bc5c62c664c4dac986cb9db5f7e789
SSDEEP

6144:T/Jp9h4DsfBZU1PgsWvYfkamQioAAJjGZHgyq1u:rthssfBZUPbYXANGZjN

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/852-0-0x0000000010000000-0x00000000100A4000-memory.dmp	upx
behavioral2/memory/852-1-0x0000000010000000-0x00000000100A4000-memory.dmp	upx
behavioral2/memory/852-2-0x0000000010000000-0x00000000100A4000-memory.dmp	upx
behavioral2/memory/852-5-0x0000000010000000-0x00000000100A4000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
852	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 852	3716	rundll32.exe	83
PID 3716 wrote to memory of 852	3716	rundll32.exe	83
PID 3716 wrote to memory of 852	3716	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40446f3e59533c0acc678ee0011789b3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40446f3e59533c0acc678ee0011789b3_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:852

memory/852-0-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/852-1-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/852-3-0x0000000001440000-0x0000000001479000-memory.dmp

Filesize
228KB

Download
memory/852-2-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/852-5-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/852-4-0x000000001006C000-0x00000000100A3000-memory.dmp

Filesize
220KB

Download