2b0df65911f08a5214bff88d0f4058c5d1463d4d5e1a159d9c490c0c70b71d8c

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 03:18

Target

5ed4c8e9acefe696b703ed6fc47997db_JaffaCakes118.dll
Size

57KB
MD5

5ed4c8e9acefe696b703ed6fc47997db
SHA1

9a929c87c1e84844d09ab1c92dc0b0d966167f73
SHA256

2b0df65911f08a5214bff88d0f4058c5d1463d4d5e1a159d9c490c0c70b71d8c
SHA512

0c2ba55fcf20d62a554ef9b900c73526a2d45dca665c299364fd21b76d83aed4ceba0153e662a6f5fb297c3a4cecae071b280bb21d2e8cace74ae7e9c8d40f46
SSDEEP

1536:V2bm2IFRTaSG3vOxaIh4ShZmRqoiDs07Rf/7E5Zg:WsvlEGxDPhWqRX7E/g

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5040-0-0x0000000010000000-0x000000001000A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 5040	2060	rundll32.exe	84
PID 2060 wrote to memory of 5040	2060	rundll32.exe	84
PID 2060 wrote to memory of 5040	2060	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ed4c8e9acefe696b703ed6fc47997db_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ed4c8e9acefe696b703ed6fc47997db_JaffaCakes118.dll,#1
  2⤵
  PID:5040

memory/5040-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download