eb22e3f4136c675532f8261cc980ac52111bf46d4e4878c79ef47773b52c7bbb

Analysis

max time kernel
94s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 12:24

Target

49c4552482f1b265767047cc9eb68313_JaffaCakes118.dll
Size

69KB
MD5

49c4552482f1b265767047cc9eb68313
SHA1

36237dab1179761adefe2484b5070fb20ebbd03f
SHA256

eb22e3f4136c675532f8261cc980ac52111bf46d4e4878c79ef47773b52c7bbb
SHA512

aa73870851bb15c90952474aae040e48d50f3b083c46dd15278b99bd8fd9248d3b9b9f8955f3f138476aa98ab6b37f98f43014dc4f4d450768b2cab536fad084
SSDEEP

1536:X36KGykMzszoso8WPSze8ppw+/wIo/qspEL8p3Y9Yie:/GAEoxPSdsIo/1pY9Y

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1644-0-0x0000000010000000-0x000000001020F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 1644	224	rundll32.exe	84
PID 224 wrote to memory of 1644	224	rundll32.exe	84
PID 224 wrote to memory of 1644	224	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\49c4552482f1b265767047cc9eb68313_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\49c4552482f1b265767047cc9eb68313_JaffaCakes118.dll,#1
  2⤵
  PID:1644

memory/1644-0-0x0000000010000000-0x000000001020F000-memory.dmp

Filesize
2.1MB

Download