Analysis
-
max time kernel
51s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 02:42
Static task
static1
Behavioral task
behavioral1
Sample
a3927dbc31129dd8ae547e952767efd4_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a3927dbc31129dd8ae547e952767efd4_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/enycizl.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/enycizl.dll
Resource
win10v2004-20240508-en
General
-
Target
$PLUGINSDIR/enycizl.dll
-
Size
126KB
-
MD5
14f4e2ba434249b6232cca6099fb96fe
-
SHA1
73c7348bdd896d208d2ba899b633f670a809eb10
-
SHA256
92c435c33c683141144640a2c2d64cbc52a063101b1a5da7f49fa2f8dc1891cb
-
SHA512
4f918de0fa34ff803fc939fc8b98aabab740f69618fbb92f61f6db97ed04a18423eaf2f8660191a2967132e77b12d9a6f973b1037bc6a2f1bab50560b9c79276
-
SSDEEP
1536:gKgOSpl2kp3h7+4jKQBFgkm4hYQLS+1yzV2m64sjBpwnrc+AGjulTR:1SLlo42ONmOGkBN+AYul
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1612 4000 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3964 wrote to memory of 4000 3964 rundll32.exe 82 PID 3964 wrote to memory of 4000 3964 rundll32.exe 82 PID 3964 wrote to memory of 4000 3964 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\enycizl.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\enycizl.dll,#12⤵PID:4000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 6003⤵
- Program crash
PID:1612
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4000 -ip 40001⤵PID:1964