Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01-04-2024 22:54
Static task
static1
Behavioral task
behavioral1
Sample
7ca5a6d622c55365fda10c9e9ba8ee88_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7ca5a6d622c55365fda10c9e9ba8ee88_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ygkzme.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ygkzme.dll
Resource
win10v2004-20240226-en
General
-
Target
$PLUGINSDIR/ygkzme.dll
-
Size
33KB
-
MD5
82ef6b004a2d1441297053109ffde16c
-
SHA1
1780e9780c38e5be83008d42da2da782b5f27402
-
SHA256
5e4bf71710738a4f7f90457c76546979b65716b42125f2fe81153ed9fe2b96e1
-
SHA512
d1d7b3a038429cd0b27fbd5eb1633f6131ef68ae66f9d7dd272ca16498567b7b5e22138c5b1a91e563a617463949f3d5ab7cb7cce5a63cd1bca20f3dc5730ae2
-
SSDEEP
384:Xo2qnuTSxRReCZlWM8rFpNGZXQcwKyK/U0Paaw68tJAdtuYDWkR9Hr5KEUPP8aKD:Y2VpoPPaawptJctuY1kPyD
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3228 4076 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1760 wrote to memory of 4076 1760 rundll32.exe rundll32.exe PID 1760 wrote to memory of 4076 1760 rundll32.exe rundll32.exe PID 1760 wrote to memory of 4076 1760 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ygkzme.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ygkzme.dll,#12⤵PID:4076
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 7283⤵
- Program crash
PID:3228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4076 -ip 40761⤵PID:4368