Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 20:19
Static task
static1
Behavioral task
behavioral1
Sample
a22cdee2c6f9ddb095c160bcc58c7141_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a22cdee2c6f9ddb095c160bcc58c7141_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/bguchhc.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/bguchhc.dll
Resource
win10v2004-20240508-en
General
-
Target
$PLUGINSDIR/bguchhc.dll
-
Size
170KB
-
MD5
c7e411a578fb9715da0ad69008dd87ce
-
SHA1
38ec16f404292a7f4c14e300975a400b25431337
-
SHA256
fff0a1936fa2d01bb3ddd3b037bfc773cf9704cfe2650137abe28547c3d0d8c2
-
SHA512
af807601e5c128302f6ac4b2042f08cc745034da426dda2645b6e0e8bc691d07bcbc092f7d4499a01f744affd082c26a1aba222ae0c0032f88daa53e4e0264bf
-
SSDEEP
3072:GxHLx5QOoA6gUuTtWTpxn9jrD2X/+0wYzu6cU:4LM2porDOmEcU
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2012 1636 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2016 wrote to memory of 1636 2016 rundll32.exe 28 PID 2016 wrote to memory of 1636 2016 rundll32.exe 28 PID 2016 wrote to memory of 1636 2016 rundll32.exe 28 PID 2016 wrote to memory of 1636 2016 rundll32.exe 28 PID 2016 wrote to memory of 1636 2016 rundll32.exe 28 PID 2016 wrote to memory of 1636 2016 rundll32.exe 28 PID 2016 wrote to memory of 1636 2016 rundll32.exe 28 PID 1636 wrote to memory of 2012 1636 rundll32.exe 29 PID 1636 wrote to memory of 2012 1636 rundll32.exe 29 PID 1636 wrote to memory of 2012 1636 rundll32.exe 29 PID 1636 wrote to memory of 2012 1636 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\bguchhc.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\bguchhc.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 2203⤵
- Program crash
PID:2012
-
-