Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-04-2024 19:16
Static task
static1
Behavioral task
behavioral1
Sample
94dfabcfd1c2a9197ff2938cd52bad46_JaffaCakes118.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
94dfabcfd1c2a9197ff2938cd52bad46_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/kwhtcvb.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/kwhtcvb.dll
Resource
win10v2004-20240226-en
General
-
Target
$PLUGINSDIR/kwhtcvb.dll
-
Size
24KB
-
MD5
c47052adbbfd727643e1f813bbee9d0a
-
SHA1
393318978321ed22187c5c81482399f253ffe1e2
-
SHA256
48f8ef93b698568f608e762cacef1b29a80bcf54bde9534a1de426242e86209a
-
SHA512
1dca295a1a76cf34e7b5e6463c3479ac42b1ec54486eba416c76248ef0a3ce63c1e4149eb9bc86a400c441210881c389957b0ffc04f6ba2880dde9daa5bada3c
-
SSDEEP
384:Rrecw0IDT07tzQ7+Lw3tJnZ2qQLjA4t9WMAZc6WnJ520mNT3s+0XMug:DwN07hrw3DnNsaMAZE2jT8+eM
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2376 848 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1804 wrote to memory of 848 1804 rundll32.exe rundll32.exe PID 1804 wrote to memory of 848 1804 rundll32.exe rundll32.exe PID 1804 wrote to memory of 848 1804 rundll32.exe rundll32.exe PID 1804 wrote to memory of 848 1804 rundll32.exe rundll32.exe PID 1804 wrote to memory of 848 1804 rundll32.exe rundll32.exe PID 1804 wrote to memory of 848 1804 rundll32.exe rundll32.exe PID 1804 wrote to memory of 848 1804 rundll32.exe rundll32.exe PID 848 wrote to memory of 2376 848 rundll32.exe WerFault.exe PID 848 wrote to memory of 2376 848 rundll32.exe WerFault.exe PID 848 wrote to memory of 2376 848 rundll32.exe WerFault.exe PID 848 wrote to memory of 2376 848 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\kwhtcvb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\kwhtcvb.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 2763⤵
- Program crash
PID:2376