d9c012d19373801a94f2659cdb75d77ab809f0c5f9c259942a0df433757fac2a

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 07:24

Target

66a6329cc11396aef67fcc52dc810827_JaffaCakes118.dll
Size

71KB
MD5

66a6329cc11396aef67fcc52dc810827
SHA1

9dd6c631ea9f1e1601782de74add2b75839b8595
SHA256

d9c012d19373801a94f2659cdb75d77ab809f0c5f9c259942a0df433757fac2a
SHA512

a0e183687134d5f4900cc15f1f35f1e5d6789d5bed5111559e35add0f7bb0a018af0bfe459dcb67e6367537e821c8ff08af0cda9571032284b87378af1dd9da5
SSDEEP

1536:agF0eiyUcb2KYQc3B7SazBehSJWH8bxkaLXXBlcq7E0d1Wi1x:t2yF9dW1xe8b+aLHBlcad1x

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2020-0-0x0000000010000000-0x0000000010011000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 2020	4440	rundll32.exe	84
PID 4440 wrote to memory of 2020	4440	rundll32.exe	84
PID 4440 wrote to memory of 2020	4440	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66a6329cc11396aef67fcc52dc810827_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\66a6329cc11396aef67fcc52dc810827_JaffaCakes118.dll,#1
  2⤵
  PID:2020

memory/2020-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download