2aef1d72ce41c573076064d32d0b73fa095e7bf4d1ef770690138fce337f782c

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2024 07:03

Target

40a9200d7f60be24934c1ee42fd97aa1_JaffaCakes118.dll
Size

75KB
MD5

40a9200d7f60be24934c1ee42fd97aa1
SHA1

68d0f519748bf507a5fc54912ceb3e98d383ce94
SHA256

2aef1d72ce41c573076064d32d0b73fa095e7bf4d1ef770690138fce337f782c
SHA512

7d035d8d89a394c3446d5b3de3da7a3d6b7ec9a964efdf621ddc28d202a6569f678cb047168d1600018b1b206dcd72192e6126f937a9dc85afe1a05730a9a27b
SSDEEP

1536:MhBRVgrExucMgbM8t1/9/pjLlBninvbmViu:cRRsgM8t1V/pjLbivbmF

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1968-0-0x0000000010000000-0x0000000010017000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 1968	5044	rundll32.exe	83
PID 5044 wrote to memory of 1968	5044	rundll32.exe	83
PID 5044 wrote to memory of 1968	5044	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40a9200d7f60be24934c1ee42fd97aa1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40a9200d7f60be24934c1ee42fd97aa1_JaffaCakes118.dll,#1
  2⤵
  PID:1968

memory/1968-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download