aaad808725b82b800859d89bafe1b28d6655102974f1fd690df7896628335459

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 23:18

Target

fb64402200f922d4ba31574503b849db_JaffaCakes118.dll
Size

97KB
MD5

fb64402200f922d4ba31574503b849db
SHA1

4f48d126eb2e811a0fbb78890be923181f4c6da7
SHA256

aaad808725b82b800859d89bafe1b28d6655102974f1fd690df7896628335459
SHA512

2253b9c301c6274de36b3005d0a423f9d41e0664d393507d853671599a5a7c63dae48f31711866066a749c1b558759f01d5df941c0cb096d3dbaf700991dd4c4
SSDEEP

3072:yi015SDd7OQHsXMieAECNlhDeXCDI4WTF5G6Swl:D25SDR+PbDaGI

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4852-0-0x0000000010000000-0x000000001002C000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2448	4852	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 4852	2260	rundll32.exe	85
PID 2260 wrote to memory of 4852	2260	rundll32.exe	85
PID 2260 wrote to memory of 4852	2260	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb64402200f922d4ba31574503b849db_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb64402200f922d4ba31574503b849db_JaffaCakes118.dll,#1
  2⤵
  PID:4852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 548
    3⤵
    - Program crash
    PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4852 -ip 4852
1⤵
PID:220

memory/4852-0-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download