3e54373e7a4440b978152ff7e25ecea31ccc7856e6ece05a8e09c96126c31379

Analysis

max time kernel
135s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 22:58

Target

47253095e4ef9a8d143b39cbe1859e33_JaffaCakes118.dll
Size

114KB
MD5

47253095e4ef9a8d143b39cbe1859e33
SHA1

1515159af06335a973cbff484a6e18f27a986652
SHA256

3e54373e7a4440b978152ff7e25ecea31ccc7856e6ece05a8e09c96126c31379
SHA512

a69c3b5629645a1589624c900abb7cb22beb4069d7e05af2f86bf1f9604847333c49d7f7c90d9225cf2b01d5e452598d247428855bf7c62d8c11f1bdd38c7359
SSDEEP

1536:/ePxCUjeSp7qrnhBbgA6U7eLKe5zl8/ESnM4ib4sfiDN9HBSecfhaNadlI:WPxpuLhl6P5ze/ESnM4ib4D7Bshan

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3436-0-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 3436	3516	rundll32.exe	83
PID 3516 wrote to memory of 3436	3516	rundll32.exe	83
PID 3516 wrote to memory of 3436	3516	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47253095e4ef9a8d143b39cbe1859e33_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\47253095e4ef9a8d143b39cbe1859e33_JaffaCakes118.dll,#1
  2⤵
  PID:3436

memory/3436-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download