6cd824c442922f9e41641909b7869fb942237aecd6fb74d91e3582f7e4b08c3d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 05:46

Target

448d3cf157dae46eb93b79248b29b23d_JaffaCakes118.dll
Size

42KB
MD5

448d3cf157dae46eb93b79248b29b23d
SHA1

89cb43626d3505403ad5933f9d109300ae2d83fa
SHA256

6cd824c442922f9e41641909b7869fb942237aecd6fb74d91e3582f7e4b08c3d
SHA512

a3b18fd524218029e4861eae842341868ea7bca3f05d3b9419c59b12d8314705fb94edb37699264c7ad2c9392b4ec6b0f9cb393e6b6de7a36ba0d88d1bda0cb0
SSDEEP

384:2+Vbx8p9MPSg2TqE0tJQ8OAYBrJrAS3snFXiQuJi46/okJMyW6YWNJJFQ:2ebxBPWqE0t1J6Ffc6FMZ6kJ

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3520-0-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 3520	1088	rundll32.exe	83
PID 1088 wrote to memory of 3520	1088	rundll32.exe	83
PID 1088 wrote to memory of 3520	1088	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\448d3cf157dae46eb93b79248b29b23d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\448d3cf157dae46eb93b79248b29b23d_JaffaCakes118.dll,#1
  2⤵
  PID:3520

memory/3520-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download