a3824f60f1ca94bd998273f853e3308f9d5a2e1f6844a85cc6b61d6317360251

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 07:00

Target

40a7123b6cea1041e16bbd76cc2c03c2_JaffaCakes118.dll
Size

70KB
MD5

40a7123b6cea1041e16bbd76cc2c03c2
SHA1

be891adf1ac510cadd1d56b7b982c49a395c9686
SHA256

a3824f60f1ca94bd998273f853e3308f9d5a2e1f6844a85cc6b61d6317360251
SHA512

b21b50d489ec733fc34ccfa9329ff0eee64a924967a90a84d68793114ef00b4414a932c54d40ce70f4b5da238d1a7f2d584fad3b3ec46b918ea91591c2e42adb
SSDEEP

1536:EGlilzZDNFdhWjyZqHqxusfNzPhCM+d6T3LeZFeoDxCn:EGluzZNtWjyGqcczPhbLee2Cn

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3424-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 3424	3384	rundll32.exe	85
PID 3384 wrote to memory of 3424	3384	rundll32.exe	85
PID 3384 wrote to memory of 3424	3384	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40a7123b6cea1041e16bbd76cc2c03c2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40a7123b6cea1041e16bbd76cc2c03c2_JaffaCakes118.dll,#1
  2⤵
  PID:3424

memory/3424-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download