413db5dfbe9da7e10b36de4e79b92dc8d9836fb079119983efaea8a42f0749f9

Analysis

max time kernel
141s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 21:01

Target

6161b98febb83a71509ef4ae8da8e040_JaffaCakes118.dll
Size

11KB
MD5

6161b98febb83a71509ef4ae8da8e040
SHA1

7b6d9e27798859ea0bd6fb821123348691f6cd51
SHA256

413db5dfbe9da7e10b36de4e79b92dc8d9836fb079119983efaea8a42f0749f9
SHA512

d3ab019df8c3129df2bdef203727a9f26c1fe06dee96d1ffcb9e6083bf35d121c913ab958c689e66bb4e3575a9ac8632779bccc75448c0f6821df00be1d3fe94
SSDEEP

192:g+vyB2KjCWUruveAODIFw1GP1s7xRyWPs9R1d94/s82NT3GgJr1:gtbCweA1w1e4jsd6x2R3Gg/

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1676-0-0x0000000010000000-0x000000001000A000-memory.dmp	upx
behavioral2/memory/1676-1-0x0000000010000000-0x000000001000A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 1676	3916	rundll32.exe	84
PID 3916 wrote to memory of 1676	3916	rundll32.exe	84
PID 3916 wrote to memory of 1676	3916	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6161b98febb83a71509ef4ae8da8e040_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6161b98febb83a71509ef4ae8da8e040_JaffaCakes118.dll,#1
  2⤵
  PID:1676

memory/1676-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/1676-1-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download