8d382ac202617809f18aaf8629352c8f7962a315b2991d59be70e9c7be7c16e9

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 11:31

Target

45a08b33448eabf88d4027314d397d1b_JaffaCakes118.dll
Size

71KB
MD5

45a08b33448eabf88d4027314d397d1b
SHA1

ca7602c9477e93250ea8eebe6bbb97076ff25c22
SHA256

8d382ac202617809f18aaf8629352c8f7962a315b2991d59be70e9c7be7c16e9
SHA512

14175917f08effca794f56476f9971109c35b6f72bdb8e0dce80e1c37d1aad18e493f41ad4b61bea2c46110626bf8ceb2744674ac53454c07bc53d5a9df7c8e7
SSDEEP

1536:mPO6KEVbsVP0gYBx4qdhICL2EbWXVdAKC0ySipF1HoqnijMpvqro7SE28:cMEVbsVcXBaqjINEgAKCdp7IqniovgMl

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3860-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 3860	3996	rundll32.exe	83
PID 3996 wrote to memory of 3860	3996	rundll32.exe	83
PID 3996 wrote to memory of 3860	3996	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45a08b33448eabf88d4027314d397d1b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\45a08b33448eabf88d4027314d397d1b_JaffaCakes118.dll,#1
  2⤵
  PID:3860

memory/3860-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download