Analysis
-
max time kernel
129s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 03:45
Static task
static1
Behavioral task
behavioral1
Sample
65e52dca58cfd731f7956d6be27fe05b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
65e52dca58cfd731f7956d6be27fe05b_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/ffumgqx.dll
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/ffumgqx.dll
Resource
win10v2004-20240426-en
General
-
Target
$PLUGINSDIR/ffumgqx.dll
-
Size
126KB
-
MD5
691ca53c333f7121772a578c5ef52e03
-
SHA1
7b23651f694baf236804c4e53ed207bd61d73dea
-
SHA256
67f8f5af2fd66ef7ec1dceace9b8f0fa4894dd4a2f19df181c93806700768be1
-
SHA512
0b37221534648a9e9d0ba4b6aef978e99661fad140a79e0968330828ca5c671474aa0f25a5c7a1cad6136fdc36f2c2a8dd84a5d0b720eb971b0312dce95f91d7
-
SSDEEP
1536:O9BySpfSZ0pEwFvsXBfRQo1OQZo7bS21az9GmdosjhhAnrc+ZOv/uoTJ7:RSx4wiXgUOPtkh1+ZO3uo9
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 888 3552 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3956 wrote to memory of 3552 3956 rundll32.exe rundll32.exe PID 3956 wrote to memory of 3552 3956 rundll32.exe rundll32.exe PID 3956 wrote to memory of 3552 3956 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ffumgqx.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ffumgqx.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 6003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3552 -ip 35521⤵