9af7bedfd578227f1094b133a1766a7907963d743cc0d63776773c4cdfd5cbc1

Analysis

max time kernel
95s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 04:43

Target

445b605e6178a40773cce51d9a9e6f09_JaffaCakes118.dll
Size

83KB
MD5

445b605e6178a40773cce51d9a9e6f09
SHA1

2e75a66db3071086c396d8e1e84c7b8e813a30e5
SHA256

9af7bedfd578227f1094b133a1766a7907963d743cc0d63776773c4cdfd5cbc1
SHA512

d497ccdcc1e507c55cf986b043e03991ae21e04f637789e367747500dab136dfe3b480f07897fa363067e8e71a6736feb1325f065bce09ed6a4ecaa305ee35ea
SSDEEP

1536:i1VkoCmGXhbBGBErDbWhIQoSmytH05A92ciDU4C836ux7gmQkZto:i1vnGz1r2IryWq2cwU48mQQo

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2868-0-0x0000000000400000-0x000000000043C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2868	624	rundll32.exe	83
PID 624 wrote to memory of 2868	624	rundll32.exe	83
PID 624 wrote to memory of 2868	624	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\445b605e6178a40773cce51d9a9e6f09_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\445b605e6178a40773cce51d9a9e6f09_JaffaCakes118.dll,#1
  2⤵
  PID:2868

memory/2868-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download