6f96a7d15243c07db657ec70461dbe7bfae3184e5e87aba88a81fe51ce6d932a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 01:19

Target

6236a4c6c8f55891bf50d00b7eca4b36_JaffaCakes118.dll
Size

9KB
MD5

6236a4c6c8f55891bf50d00b7eca4b36
SHA1

fc02a2e917fc455c783987c4a6b3644831d511f3
SHA256

6f96a7d15243c07db657ec70461dbe7bfae3184e5e87aba88a81fe51ce6d932a
SHA512

a39f46e5fc2a6222580809e232121cf530f6972e6dff2bf0736164892ab24fd7000ac3d159014fe8b51fff8b75897a0dcca468d6c907477d94051aa5175f5b29
SSDEEP

96:2E5NOAXdhfop5zArGQwAXRbsnXWVb8Ivl08R85h/HMrASnF5QVjXIvN+FUKtOdaj:2D+Op5jrYb8IvlLR8jMPnwyMFbEkx

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2348-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 2348	4652	rundll32.exe	83
PID 4652 wrote to memory of 2348	4652	rundll32.exe	83
PID 4652 wrote to memory of 2348	4652	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6236a4c6c8f55891bf50d00b7eca4b36_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6236a4c6c8f55891bf50d00b7eca4b36_JaffaCakes118.dll,#1
  2⤵
  PID:2348

memory/2348-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download