0bbf6f8b688665ecba1548e43903d6019b140020f10195e2a08d3cdbddeabb33

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 01:20

Target

62379db8ebc83f85bd02d3d05c94b71d_JaffaCakes118.dll
Size

57KB
MD5

62379db8ebc83f85bd02d3d05c94b71d
SHA1

480ae79e00ae47358f4a3e03eca86de577befe51
SHA256

0bbf6f8b688665ecba1548e43903d6019b140020f10195e2a08d3cdbddeabb33
SHA512

89a314de7626e9812b82f4063aa97816b19630de1769674d9ff2abef666553ed97929568ed1c7802c923e18782fcb115291397ced5f53e9b125492a6797eb165
SSDEEP

1536:qmmMttwBSvdHIBe5ydkqGSMC2udMQ11Zal9LMhYa:QMPwB3BWydcCkGZo6H

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2288-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 2288	4744	rundll32.exe	84
PID 4744 wrote to memory of 2288	4744	rundll32.exe	84
PID 4744 wrote to memory of 2288	4744	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\62379db8ebc83f85bd02d3d05c94b71d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\62379db8ebc83f85bd02d3d05c94b71d_JaffaCakes118.dll,#1
  2⤵
  PID:2288

memory/2288-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download