4da4d3c3e081cac61dfb6d26cc2737924025cd77a88df58c45548d998bfbb611

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 19:22

Target

4302f6c7e515930f2928399d208b1617_JaffaCakes118.dll
Size

34KB
MD5

4302f6c7e515930f2928399d208b1617
SHA1

cf35c02037e7133fbafb845f3c9db64d80451d14
SHA256

4da4d3c3e081cac61dfb6d26cc2737924025cd77a88df58c45548d998bfbb611
SHA512

95f036aa16728fe13ebdb10913e44b232b6338486988da8398a2dc94ac526116bba3acb16195ea22706c79e3747cd3c78e6b8d8e9550d97a39f48859bd32c3e6
SSDEEP

768:56IRmOOuKDowVUuxzp07IYhqkiTxvXXler4NVK:5jRmO9MU8zp93XVhVK

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5096-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 5096	2876	rundll32.exe	83
PID 2876 wrote to memory of 5096	2876	rundll32.exe	83
PID 2876 wrote to memory of 5096	2876	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4302f6c7e515930f2928399d208b1617_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4302f6c7e515930f2928399d208b1617_JaffaCakes118.dll,#1
  2⤵
  PID:5096

memory/5096-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download