Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 09:57
Static task
static1
Behavioral task
behavioral1
Sample
a4f620d0d26f46e65ae098b122c2685d_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a4f620d0d26f46e65ae098b122c2685d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240611-en
General
-
Target
$PLUGINSDIR/nsDialogs.dll
-
Size
9KB
-
MD5
b3070cf20db659fdfb3cb2ed38130e8d
-
SHA1
aa234b0620bebddde1414ff6b0840d883890b413
-
SHA256
f2c1409faf2952c1c91f4b5495158ef5c7d1a1db6eea4a18f163574bd52fcad0
-
SHA512
4849a4cf24ea8a26cd04eb132d479cc093d4e204ed3866a77646d03778f4c128e20722a0c3cd62ea98a37deea4ce505fe632420158c71a10b0c8c5e32b38e3f1
-
SSDEEP
96:oEqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx40qndYHnxss:oEq+CP3uKrpyREs06YxEdGn
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3676 4044 WerFault.exe 81 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3196 wrote to memory of 4044 3196 rundll32.exe 81 PID 3196 wrote to memory of 4044 3196 rundll32.exe 81 PID 3196 wrote to memory of 4044 3196 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#12⤵PID:4044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 6363⤵
- Program crash
PID:3676
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4044 -ip 40441⤵PID:4792