27eff9f90a212c188ea2d183611b2896d10964766203573b4c2bbc41724b7b11

Analysis

max time kernel
142s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 12:04

Target

5bdcec6e42904f1941376ff24be9e272_JaffaCakes118.dll
Size

54KB
MD5

5bdcec6e42904f1941376ff24be9e272
SHA1

86df72a10a762fafab66c53dd6efce04cff92ed2
SHA256

27eff9f90a212c188ea2d183611b2896d10964766203573b4c2bbc41724b7b11
SHA512

2ab72d0a4aef008e9518cca66719f96e2d4f2baf7711232b047ceb8c46fbffdb5762c583646c44616b5a765e3c91e3b3bbfef626bfe3f0fcfd4400e7101fba21
SSDEEP

1536:knK0jhOKw+PqRLGwghlarqSDKgAyx/sR4TKifgayM:knNhOKw+P+PghlrmK7yx/rTFfHb

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/404-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 404	3060	rundll32.exe	84
PID 3060 wrote to memory of 404	3060	rundll32.exe	84
PID 3060 wrote to memory of 404	3060	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bdcec6e42904f1941376ff24be9e272_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bdcec6e42904f1941376ff24be9e272_JaffaCakes118.dll,#1
  2⤵
  PID:404

memory/404-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download