b860cff082ec10cdf088fa486ec82cba7cdb30b65cfc411e5860d357667b46e7

Analysis

max time kernel
138s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 21:28

Target

f8c91dc82e921892bd0af248f9095517_JaffaCakes118.dll
Size

76KB
MD5

f8c91dc82e921892bd0af248f9095517
SHA1

2c7ba9c100b0571f195f55b3620877481ba1f0c2
SHA256

b860cff082ec10cdf088fa486ec82cba7cdb30b65cfc411e5860d357667b46e7
SHA512

724a273c4bc34e05ffe78b13665d782cd25a96095a6bd124844706c83369cccf8e6742d97f0ac7d22289f4983a48c558a94ff575c6811fd0d04af6f77b3c0013
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Zu4vs8AaAMMPD:c8y93KQjy7G55riF1cMo0304U8AaAM+

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1504-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1504-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3604	1504	WerFault.exe	92

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 1504	4244	rundll32.exe	92
PID 4244 wrote to memory of 1504	4244	rundll32.exe	92
PID 4244 wrote to memory of 1504	4244	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8c91dc82e921892bd0af248f9095517_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8c91dc82e921892bd0af248f9095517_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 696
    3⤵
    - Program crash
    PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1504 -ip 1504
1⤵
PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:4908

memory/1504-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1504-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download