8c2bcddc31eed5572f8098b1921abfc9f23157d2cc3c9e3702afd8d0092b1961

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 23:39

Target

f9010f647f6ab507c6225a50d4199ee6_JaffaCakes118.dll
Size

10KB
MD5

f9010f647f6ab507c6225a50d4199ee6
SHA1

78cce70dc27b85862ad280d0d30b5eb9021a3832
SHA256

8c2bcddc31eed5572f8098b1921abfc9f23157d2cc3c9e3702afd8d0092b1961
SHA512

ccbf21414d4c439aa15136036d534207b652b68279dc4c0ea8e73749278ba28f4108543f73967da36ae082192bfd98cdd03cbdf49839e23398ff996eb321ca24
SSDEEP

192:9sBWG/5Hf4Hc8Hdq2RYhy+hVEyyJCwXArrFLkbqmosuO:ONhHwHc8fAWy0XArrFgmm5

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4428-0-0x0000000010000000-0x000000001000A000-memory.dmp	upx
behavioral2/memory/4428-1-0x0000000010000000-0x000000001000A000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1716	4428	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 4428	1136	rundll32.exe	85
PID 1136 wrote to memory of 4428	1136	rundll32.exe	85
PID 1136 wrote to memory of 4428	1136	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9010f647f6ab507c6225a50d4199ee6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9010f647f6ab507c6225a50d4199ee6_JaffaCakes118.dll,#1
  2⤵
  PID:4428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 640
    3⤵
    - Program crash
    PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4428 -ip 4428
1⤵
PID:4196

memory/4428-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/4428-1-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download