421e1f86cff117373289296d95c9a140e33115837fa4f5020cdcf52947e8e235

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 03:54

Target

481c887246ef56159dbf340a00170f12_JaffaCakes118.dll
Size

97KB
MD5

481c887246ef56159dbf340a00170f12
SHA1

e8d07efffa83c8957813f67d704ec904e1367e39
SHA256

421e1f86cff117373289296d95c9a140e33115837fa4f5020cdcf52947e8e235
SHA512

e16f3c69e7bb272ac8e7a6f65874aef3c871bc0e714920bc951123a4ca95863f1b2eba3883c8cac3a0f09e31a1a33a6951960394c56df7bd364b146ea8b45db3
SSDEEP

1536:ISKyVLql4k6MEymJKz9O/Vuq6913hrxJRk1sEX25ulG9IX:ISKyVLqikzEyh+SNRaX2sG9i

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4572-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 4572	1148	rundll32.exe	83
PID 1148 wrote to memory of 4572	1148	rundll32.exe	83
PID 1148 wrote to memory of 4572	1148	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\481c887246ef56159dbf340a00170f12_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\481c887246ef56159dbf340a00170f12_JaffaCakes118.dll,#1
  2⤵
  PID:4572

memory/4572-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download