3b15eb41bb9bd2eba8635b14743230b7a63d23b4a15271744e60b109e134e2d2

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 14:41

Target

421b5a50d7a5278c72474d7b4da7ad79_JaffaCakes118.dll
Size

81KB
MD5

421b5a50d7a5278c72474d7b4da7ad79
SHA1

9331519f92dc7fe6b7ff4cc25a7f036230292cd2
SHA256

3b15eb41bb9bd2eba8635b14743230b7a63d23b4a15271744e60b109e134e2d2
SHA512

715dab1e9efd6170c68c2876cf3ec7e418af5f644864e742baee3ff7630fea4159d1e4d439ce2e90cd42a11528a4d698af8fc92ae63af5064814ab848dbbdd8d
SSDEEP

1536:V8O9Nn6RjrijyB5RakNebCsWnaVLas8kMywroQJPbmlKepf+wCYryz0d/byTY55Y:2Oz6VW2B5lsVL/8kMImP4fqYryz0dOc0

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2164-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2164	2616	rundll32.exe	83
PID 2616 wrote to memory of 2164	2616	rundll32.exe	83
PID 2616 wrote to memory of 2164	2616	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\421b5a50d7a5278c72474d7b4da7ad79_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\421b5a50d7a5278c72474d7b4da7ad79_JaffaCakes118.dll,#1
  2⤵
  PID:2164

memory/2164-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download