3064c065524b59f18a808613e5c50cb18d029ea8d3a0f25316ec6c945da34193

Analysis

max time kernel
138s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 11:59

Target

632582511773a948ae28abbd65dda27e_JaffaCakes118.dll
Size

66KB
MD5

632582511773a948ae28abbd65dda27e
SHA1

063b973b2525219333b8fe73b5efa83f9ad2dc7f
SHA256

3064c065524b59f18a808613e5c50cb18d029ea8d3a0f25316ec6c945da34193
SHA512

c8599fabcfed7809cf1bc0689dd7c8e524c08419e60a542eb973e74005634bf9d1d6ad482ba9a60dcb32f030a91610a70d3643069bfb137ea310f86e2d6eced3
SSDEEP

1536:2m7jMn845fnbE7PYvxAdWnH/x4VJXNQDSxWxqYqN/EmcM:2Sj5mb4YvkWHJQXTIqT/EmcM

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3312-0-0x0000000010000000-0x0000000010037000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 3312	4776	regsvr32.exe	84
PID 4776 wrote to memory of 3312	4776	regsvr32.exe	84
PID 4776 wrote to memory of 3312	4776	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\632582511773a948ae28abbd65dda27e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\632582511773a948ae28abbd65dda27e_JaffaCakes118.dll
  2⤵
  PID:3312

memory/3312-0-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download