1eef936bbc7095570278575cbc39d47e3b73ed93b49758c18da6cb8e9ecb4173

Analysis

max time kernel
144s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 15:08

Target

fd09fc0c9eced14a46439ac52cb8748a_JaffaCakes118.dll
Size

66KB
MD5

fd09fc0c9eced14a46439ac52cb8748a
SHA1

9653dc9f1f6cc9e99d7eea4092a99266d469d4c1
SHA256

1eef936bbc7095570278575cbc39d47e3b73ed93b49758c18da6cb8e9ecb4173
SHA512

3dd05510af6384db709fe62190fbe30b03ec37685a6c456bd5356437315c71920052e4bdf526d89e560b58764bee871438353a81799023c2e45d9fec72b0c185
SSDEEP

1536:YRcCGPNvBMYOm1NHkDn8qJjfmMkX4NwlDiJO4N4JsI9FuZq3:NCGP3MYvCDn1Jju54SKNqFuZq3

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4896-0-0x0000000010000000-0x0000000010042000-memory.dmp	upx
behavioral2/memory/4896-1-0x0000000010000000-0x0000000010042000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3908	4896	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 4896	4640	rundll32.exe	85
PID 4640 wrote to memory of 4896	4640	rundll32.exe	85
PID 4640 wrote to memory of 4896	4640	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd09fc0c9eced14a46439ac52cb8748a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd09fc0c9eced14a46439ac52cb8748a_JaffaCakes118.dll,#1
  2⤵
  PID:4896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 692
    3⤵
    - Program crash
    PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4896 -ip 4896
1⤵
PID:4036

memory/4896-0-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download
memory/4896-1-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download