f1253c4b3159e1c6ccae67c8a0d13f6ada8955b4e8ba449cda909d42bd9de3ff

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 16:14

Target

4690eeca1d9c964580985c85c3908a15_JaffaCakes118.dll
Size

61KB
MD5

4690eeca1d9c964580985c85c3908a15
SHA1

828604354511a6c9511cb97405e19223b5583076
SHA256

f1253c4b3159e1c6ccae67c8a0d13f6ada8955b4e8ba449cda909d42bd9de3ff
SHA512

ed0eef5df6138d7955784f9c36bec3a9f83fb731915c19cf6cf4a783c164da23e965c69c2ca4ab3490c88cb8cb11f23b2624bb89c0766c950fb7e9c9355541f9
SSDEEP

1536:OzN56+Ijs8hGUwOmOu+TWI/ZyNc5TBsgDMp+R:OzO+IZjuWR3TrMpA

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4040-0-0x0000000010000000-0x000000001096E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 4040	2420	rundll32.exe	83
PID 2420 wrote to memory of 4040	2420	rundll32.exe	83
PID 2420 wrote to memory of 4040	2420	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4690eeca1d9c964580985c85c3908a15_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4690eeca1d9c964580985c85c3908a15_JaffaCakes118.dll,#1
  2⤵
  PID:4040

memory/4040-0-0x0000000010000000-0x000000001096E000-memory.dmp

Filesize
9.4MB

Download
memory/4040-1-0x0000000010000000-0x000000001096E000-memory.dmp

Filesize
9.4MB

Download