2a0779ed236ffba9d866e2e732d7772e3e75279b57584aa52da9daa4fbd9fed1

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 13:57

Target

67d8b8cae05308f477c67cf6fe8a1523_JaffaCakes118.dll
Size

54KB
MD5

67d8b8cae05308f477c67cf6fe8a1523
SHA1

5f274ce104bea5749cd1c24b918a99c01b89b329
SHA256

2a0779ed236ffba9d866e2e732d7772e3e75279b57584aa52da9daa4fbd9fed1
SHA512

8a4ffe30ed9a417878878b7a5c2e0e003c3a5e7605edae4fff7463d4062845e482615b0156898569137bcc14a4c7e8e7ad8ea3e93169086be35980d7a5d1be72
SSDEEP

768:nbY4lGn9XPflrl5caikKMBv/S2xTeqoyaUB3pkk6qXAKdB7JXnNoG+w2XPVqA3mF:EGynlrDrrCiJ5kFmAKv9XWGZ69z1PWcW

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3956-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 3956	4628	rundll32.exe	83
PID 4628 wrote to memory of 3956	4628	rundll32.exe	83
PID 4628 wrote to memory of 3956	4628	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67d8b8cae05308f477c67cf6fe8a1523_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\67d8b8cae05308f477c67cf6fe8a1523_JaffaCakes118.dll,#1
  2⤵
  PID:3956

memory/3956-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download