429593a96c5465a042e2309432cb2b7c9342fbe95d2040501dbee43a3e3e3680

Analysis

max time kernel
135s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 08:03

Target

66c2fbe39bd72bf14f2e39392a873b1f_JaffaCakes118.dll
Size

61KB
MD5

66c2fbe39bd72bf14f2e39392a873b1f
SHA1

0bb5ec72729bc952b7c97c7a90833fed9935ccbe
SHA256

429593a96c5465a042e2309432cb2b7c9342fbe95d2040501dbee43a3e3e3680
SHA512

e97a88aadc8269c55fbd0b67f7691aa499eec11213332745e2f58b774f0d5f3da2fb4d5aaf3d2c3ec1ab13d0c6e92e30b108a22f229044ecbdbe492f1711ebee
SSDEEP

1536:EG2iuPZOFRHC5XVeCUDiyOyFRPhVLay3usYROb:EG6czs5uRHaaLb

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1760-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 1760	2580	rundll32.exe	85
PID 2580 wrote to memory of 1760	2580	rundll32.exe	85
PID 2580 wrote to memory of 1760	2580	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66c2fbe39bd72bf14f2e39392a873b1f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\66c2fbe39bd72bf14f2e39392a873b1f_JaffaCakes118.dll,#1
  2⤵
  PID:1760

memory/1760-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download