afd06340f17c65ad82e3eaca6d63f43e2fce2d04d6ea8187eadb2a1d740e32af

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 12:46

Target

5c0050262342e69739875b0b812fdcd7_JaffaCakes118.dll
Size

51KB
MD5

5c0050262342e69739875b0b812fdcd7
SHA1

752cb660b6cb9e0225151b1ab239c89dc777a1fb
SHA256

afd06340f17c65ad82e3eaca6d63f43e2fce2d04d6ea8187eadb2a1d740e32af
SHA512

c2adfb51df50a60ae5bf9b1a1301ec8b3462fd0c0abc41ff4e7f44eddda1e99669c15ebea14b5fd45006661cc989d0583d41df52fbd82845df3790dfbfb08833
SSDEEP

768:yuUr3ip/IHI7NQTvKS97UqGan+/1p3cK3sLMpEIUOMv9nYtRwg8O7ykN:yl3E0TiSueKvoLMUxcRw07P

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4364-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 4364	1340	rundll32.exe	84
PID 1340 wrote to memory of 4364	1340	rundll32.exe	84
PID 1340 wrote to memory of 4364	1340	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c0050262342e69739875b0b812fdcd7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c0050262342e69739875b0b812fdcd7_JaffaCakes118.dll,#1
  2⤵
  PID:4364

memory/4364-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download