Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-04-2024 22:28
Static task
static1
Behavioral task
behavioral1
Sample
98d2d5ac3bd493d77f0a7300a43d045b_JaffaCakes118.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
98d2d5ac3bd493d77f0a7300a43d045b_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/gyalquzbu.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/gyalquzbu.dll
Resource
win10v2004-20240226-en
General
-
Target
$PLUGINSDIR/gyalquzbu.dll
-
Size
33KB
-
MD5
a8caa6d267951ad22e835233b5e50c46
-
SHA1
45c722c5958d99727a95d30eaa3032203d1f4ab2
-
SHA256
db7b70b0734285b8d9a1f3617e55603b0cb649d9bf0b7fbf8988c44e684f4e76
-
SHA512
9ee74bf576554210f8923dda8aa28f6dc7f3c5aa52da7b48a94beaf56cb4e27f1c3d0387cc9116e467631bc13c0e743341129bffa84b9db16ace1248a53b4cd7
-
SSDEEP
384:8o2En0QXbRRe9fsWZAmSlmMNAC8Qqgqdq9RHvHZXktPaa+LiJtLydc8f1eWU9Rkj:L2zf9HPaa+2tLKJcMaTxOMFs0o
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1928 2028 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2164 wrote to memory of 2028 2164 rundll32.exe rundll32.exe PID 2164 wrote to memory of 2028 2164 rundll32.exe rundll32.exe PID 2164 wrote to memory of 2028 2164 rundll32.exe rundll32.exe PID 2164 wrote to memory of 2028 2164 rundll32.exe rundll32.exe PID 2164 wrote to memory of 2028 2164 rundll32.exe rundll32.exe PID 2164 wrote to memory of 2028 2164 rundll32.exe rundll32.exe PID 2164 wrote to memory of 2028 2164 rundll32.exe rundll32.exe PID 2028 wrote to memory of 1928 2028 rundll32.exe WerFault.exe PID 2028 wrote to memory of 1928 2028 rundll32.exe WerFault.exe PID 2028 wrote to memory of 1928 2028 rundll32.exe WerFault.exe PID 2028 wrote to memory of 1928 2028 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gyalquzbu.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gyalquzbu.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 2523⤵
- Program crash