264464b7effb3de122e82c752b8232a67252c91ba891f740d39288f42bf0bfd2

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2024 20:41

Target

43434ac71dfc442f2a481062cfa8bc85_JaffaCakes118.dll
Size

78KB
MD5

43434ac71dfc442f2a481062cfa8bc85
SHA1

30f6733c02386c5a8f127dfa2f6c7739b4e5eacf
SHA256

264464b7effb3de122e82c752b8232a67252c91ba891f740d39288f42bf0bfd2
SHA512

a7544cc263a3d81b05cd6efe98e198d7d7fa78dc12f7a1015e71708687aadef4801953c213cc7bb0588b1d3e60866e4ec577c2b3497b027b1e5ebf3bffaf35a5
SSDEEP

1536:Iykzkagwv29ZaOiiVEXQJP2eHdWGVX90Bb9fRurNs/p0N2:IFzkaD29ZaOiiVmPeHIoXGBxwrNeh

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4448-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 4448	3952	rundll32.exe	83
PID 3952 wrote to memory of 4448	3952	rundll32.exe	83
PID 3952 wrote to memory of 4448	3952	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43434ac71dfc442f2a481062cfa8bc85_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\43434ac71dfc442f2a481062cfa8bc85_JaffaCakes118.dll,#1
  2⤵
  PID:4448

memory/4448-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download