d5e185b74ae80462f23d208654ddb4c975cc2cf6f29c67940c9ec3b24e708d8e

Analysis

max time kernel
136s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 20:37

Target

64b7a69531ef2688c08083ab8dae604f_JaffaCakes118.dll
Size

53KB
MD5

64b7a69531ef2688c08083ab8dae604f
SHA1

454130ccd9efc1fc69d90d07be747118636cf176
SHA256

d5e185b74ae80462f23d208654ddb4c975cc2cf6f29c67940c9ec3b24e708d8e
SHA512

fe68c97161054529ae4d071624f9bf95f61f66ac92f2f638788005d79ab149d94551bd03890d6bb2e4f9f948c2f9e8b8e2aa10bfa9fd2b5674983df7744ed436
SSDEEP

768:Gx4m7JNSll3dTG+3cCDpyQV0lskFU4WVwhLvkIWBPPmtBQNmXic8VU/KaUtaKBZ:Bm1NGJVG4cifilx4whL3WB3EviKUtaKT

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2836-0-0x0000000010000000-0x0000000010013000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 2836	1480	rundll32.exe	83
PID 1480 wrote to memory of 2836	1480	rundll32.exe	83
PID 1480 wrote to memory of 2836	1480	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64b7a69531ef2688c08083ab8dae604f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64b7a69531ef2688c08083ab8dae604f_JaffaCakes118.dll,#1
  2⤵
  PID:2836

memory/2836-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download