Analysis
-
max time kernel
51s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 20:19
Static task
static1
Behavioral task
behavioral1
Sample
a22cdee2c6f9ddb095c160bcc58c7141_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a22cdee2c6f9ddb095c160bcc58c7141_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/bguchhc.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/bguchhc.dll
Resource
win10v2004-20240508-en
General
-
Target
$PLUGINSDIR/bguchhc.dll
-
Size
170KB
-
MD5
c7e411a578fb9715da0ad69008dd87ce
-
SHA1
38ec16f404292a7f4c14e300975a400b25431337
-
SHA256
fff0a1936fa2d01bb3ddd3b037bfc773cf9704cfe2650137abe28547c3d0d8c2
-
SHA512
af807601e5c128302f6ac4b2042f08cc745034da426dda2645b6e0e8bc691d07bcbc092f7d4499a01f744affd082c26a1aba222ae0c0032f88daa53e4e0264bf
-
SSDEEP
3072:GxHLx5QOoA6gUuTtWTpxn9jrD2X/+0wYzu6cU:4LM2porDOmEcU
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 232 2944 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4804 wrote to memory of 2944 4804 rundll32.exe 82 PID 4804 wrote to memory of 2944 4804 rundll32.exe 82 PID 4804 wrote to memory of 2944 4804 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\bguchhc.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\bguchhc.dll,#12⤵PID:2944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 6003⤵
- Program crash
PID:232
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2944 -ip 29441⤵PID:1008