e7828741ff0def0db61f93cb1ec72ae2d52ed5a2daae700754185bae568c0a0c

Analysis

max time kernel
140s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 05:12

Target

5f26500551d1e8ac30a9983c08e4cc89_JaffaCakes118.dll
Size

96KB
MD5

5f26500551d1e8ac30a9983c08e4cc89
SHA1

21a67dbc3a1d48cd0fbdc67af4a6f7808055d45f
SHA256

e7828741ff0def0db61f93cb1ec72ae2d52ed5a2daae700754185bae568c0a0c
SHA512

d3ca33f95555e2a46bea217a9487afc4e52a3459caa5cea5622601257fbb6b569fbdd8a12292337f83d8bfe7d6e2a40a56304bb480b53c25d601ca304715884d
SSDEEP

1536:OkzBS5SxeZw4hoS7JeXtdNU8AIon110IrqyzSkR20k0pJ1:xYSxx4hoS7JeX/AIosw9RJk0pJ1

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3816-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 3816	3448	rundll32.exe	84
PID 3448 wrote to memory of 3816	3448	rundll32.exe	84
PID 3448 wrote to memory of 3816	3448	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f26500551d1e8ac30a9983c08e4cc89_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f26500551d1e8ac30a9983c08e4cc89_JaffaCakes118.dll,#1
  2⤵
  PID:3816

memory/3816-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download