952f3305a1c823f0d91086363145e1552884db0bf553bf3954db65cc211856b1

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 12:58

Target

6344c4a7f258791b5cb9f43248841b37_JaffaCakes118.dll
Size

69KB
MD5

6344c4a7f258791b5cb9f43248841b37
SHA1

3d2af30af64b5f4b15a51876a99042775d537842
SHA256

952f3305a1c823f0d91086363145e1552884db0bf553bf3954db65cc211856b1
SHA512

30615da817e412b74192b310ee32afc8e6bbbaf3ce177b756cc241eea15e740d83f48932a504d6414a4d80f2e297bc23e6ff164591c379a9be6b50c3f148a5fe
SSDEEP

1536:Bm1NGJVGmZs4tt0bBXJsvlmJ/PgvLEDGU8HP4VqMcV0OiIdT7ZXrDuc:kX0VV64YbBZsvsJH6tacV9T7Z7DN

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/940-0-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 940	2212	rundll32.exe	84
PID 2212 wrote to memory of 940	2212	rundll32.exe	84
PID 2212 wrote to memory of 940	2212	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6344c4a7f258791b5cb9f43248841b37_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6344c4a7f258791b5cb9f43248841b37_JaffaCakes118.dll,#1
  2⤵
  PID:940

memory/940-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download