Analysis
-
max time kernel
92s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 14:33
Static task
static1
Behavioral task
behavioral1
Sample
921ff5d9fd9477d3afdc566be67e3d39_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
921ff5d9fd9477d3afdc566be67e3d39_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/gcbaxve.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/gcbaxve.dll
Resource
win10v2004-20240426-en
General
-
Target
$PLUGINSDIR/gcbaxve.dll
-
Size
161KB
-
MD5
5a43c4d89bcaffce49aac328d3f34c40
-
SHA1
28981d8a0b8cd365abff332ae2ed05c1a2c72a52
-
SHA256
a8d48c8c86706fdb03412a59d8df04ab04c2c478e1580dfdee70e03962f16e50
-
SHA512
a4c4d1c5436e28f9c0b9ed30fafb566264d4db673422aca064cb7b859eec6ef04fb72ad226852030757883a2c4292e24c2e1c072ff0eb5a08b751c8a3931382a
-
SSDEEP
3072:GQeZSxgOf6M8CvGLKBdz+tVdQbwEWZJcO:kcjfvGLKHdvkJc
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4752 2656 WerFault.exe 81 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4480 wrote to memory of 2656 4480 rundll32.exe 81 PID 4480 wrote to memory of 2656 4480 rundll32.exe 81 PID 4480 wrote to memory of 2656 4480 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gcbaxve.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gcbaxve.dll,#12⤵PID:2656
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 6003⤵
- Program crash
PID:4752
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2656 -ip 26561⤵PID:816