26a78ccffc24e595b7c9fe191b0959e75e74486e857a993cf97d9d517742a5e0

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 05:02

Target

4854e3dd1164144c01b7711e7879b085_JaffaCakes118.dll
Size

60KB
MD5

4854e3dd1164144c01b7711e7879b085
SHA1

c7b05d86b84151cc63562767feb3b8ff2179d03e
SHA256

26a78ccffc24e595b7c9fe191b0959e75e74486e857a993cf97d9d517742a5e0
SHA512

393287bed4ba6af49eefc976bfc3c559980a0d8f78cac0946e5eddd0ee638ea4f61b9cc701437d08fbdc0df6c5fc8eb19b58bc7724ddc38f0281e923f556a48c
SSDEEP

768:m+YlPqpYYqawmpDCIw5CO9pdVtLV7OrqNpy3tgw1LbZQ9Ix1AKOZWlT:tGanFFw5CgbZ1NjcRQu3AKOZWlT

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3508-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 3508	4808	rundll32.exe	83
PID 4808 wrote to memory of 3508	4808	rundll32.exe	83
PID 4808 wrote to memory of 3508	4808	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4854e3dd1164144c01b7711e7879b085_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4854e3dd1164144c01b7711e7879b085_JaffaCakes118.dll,#1
  2⤵
  PID:3508

memory/3508-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download