b85f7dc241b3f1c736635857bba6a980967b4979c8fe3bdf163783536efc9d04

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 09:55

Target

4130fee60d07e65230a062bf47b1ac3d_JaffaCakes118.dll
Size

46KB
MD5

4130fee60d07e65230a062bf47b1ac3d
SHA1

4efb5cabe16117708eebb214e7f0ed1eda51a5cf
SHA256

b85f7dc241b3f1c736635857bba6a980967b4979c8fe3bdf163783536efc9d04
SHA512

16517def781ef820008488deaa6db017a5a66d2164875ae5f32a281afea76d9cefa10c7a73fa81efe0d5f8b9571e6774ea107d5990247c2000160d63523b5ec9
SSDEEP

768:9xBtKtqyLUw4wy+nGAxS2oj6zjffR/grRf+xi49ajn/26muAXoIWUd+TUul2mex9:9G4hAFS2ouvfSFqor+fWUI5eziA9

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3260-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 3260	3524	rundll32.exe	83
PID 3524 wrote to memory of 3260	3524	rundll32.exe	83
PID 3524 wrote to memory of 3260	3524	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4130fee60d07e65230a062bf47b1ac3d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4130fee60d07e65230a062bf47b1ac3d_JaffaCakes118.dll,#1
  2⤵
  PID:3260

memory/3260-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download