7ed244a0e0d31cc5da8335ede4c588c67b6870faa85e6800da18c3e1563ee800

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 14:06

Target

49ffb1aebce0bc0ba70965e9f213b488_JaffaCakes118.dll
Size

67KB
MD5

49ffb1aebce0bc0ba70965e9f213b488
SHA1

12d9fae5e35f12d57247b9403bb71461050e484d
SHA256

7ed244a0e0d31cc5da8335ede4c588c67b6870faa85e6800da18c3e1563ee800
SHA512

3820a4419587168df26b817f4792139569b7d06e26764e25c48d521d6a58dc1b401d7dd55765d2f21107047374ddc484cd4b689ebe06374fdda69933c5960f2a
SSDEEP

1536:mtiGSJcARcmBtW0AweUwDiu1OUR5FQ4HKt4QijDNc0IsdspAH:mt0cJmGweb71lRI4HKtji9cdsd4AH

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3996-0-0x0000000010000000-0x0000000010043000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 3996	5112	rundll32.exe	83
PID 5112 wrote to memory of 3996	5112	rundll32.exe	83
PID 5112 wrote to memory of 3996	5112	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\49ffb1aebce0bc0ba70965e9f213b488_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\49ffb1aebce0bc0ba70965e9f213b488_JaffaCakes118.dll,#1
  2⤵
  PID:3996

memory/3996-0-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download