a4f2891f52163f96f450f71ef05ad3d91da22e08b90594bbcf311ed8dd0fd605

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 23:46

Target

4bed9af79ae38840c94d5dcbc2c5b57b_JaffaCakes118.dll
Size

62KB
MD5

4bed9af79ae38840c94d5dcbc2c5b57b
SHA1

058ceb1ab8231ac00417c0ef5e1b64102c16287b
SHA256

a4f2891f52163f96f450f71ef05ad3d91da22e08b90594bbcf311ed8dd0fd605
SHA512

39f3bf408d2af404558be3d4fea4591c8790b63b7e1c2396fe2f002aad52842dc4b785dac277c95263c79e3cb623467dffb624f0501a18307223c7a9bce7fb18
SSDEEP

1536:P2HT4bgH1iYJ/WpW+ugMB8KZ+bng5MI8nnouy8u:hb21iY8rvKZRaoutu

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3428-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 3428	4608	rundll32.exe	83
PID 4608 wrote to memory of 3428	4608	rundll32.exe	83
PID 4608 wrote to memory of 3428	4608	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bed9af79ae38840c94d5dcbc2c5b57b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bed9af79ae38840c94d5dcbc2c5b57b_JaffaCakes118.dll,#1
  2⤵
  PID:3428

memory/3428-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download