5d4df889a1417923a6d8cde2a7ff5ac0ffa902615ddb1e933f863aae7788257a

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 19:36

Target

6485435a0b32e437d0abb4eb10b5b23c_JaffaCakes118.dll
Size

54KB
MD5

6485435a0b32e437d0abb4eb10b5b23c
SHA1

f2bfbba58d4b4002cd08c28aad267702fe4e4649
SHA256

5d4df889a1417923a6d8cde2a7ff5ac0ffa902615ddb1e933f863aae7788257a
SHA512

16460c3f076aa7d3419a8e047994e745573022b2cab1afd263cc430fbc98276614a0529c24437a53c6fd587ba6a34db7f94e6432687ee9cfda3cfde05d8a96f8
SSDEEP

1536:n7ZLNPp9pZBMQVDXl1p+DVSAonfIN++bmDFF9:7ZppTNl1pX7fW++b0FF9

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1096-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 1096	3264	rundll32.exe	84
PID 3264 wrote to memory of 1096	3264	rundll32.exe	84
PID 3264 wrote to memory of 1096	3264	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6485435a0b32e437d0abb4eb10b5b23c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6485435a0b32e437d0abb4eb10b5b23c_JaffaCakes118.dll,#1
  2⤵
  PID:1096

memory/1096-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download