c56602f85db3bb70394935d4f405d409f766ebe3b4c39e497670b42639ecf554

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 00:45

Target

05dc4427882aef5cbd9530155fcaa988_JaffaCakes118.dll
Size

13KB
MD5

05dc4427882aef5cbd9530155fcaa988
SHA1

d0ea9ecddd4840b3ff563d9a07f46f97d5bbc235
SHA256

c56602f85db3bb70394935d4f405d409f766ebe3b4c39e497670b42639ecf554
SHA512

79cb42d2530fb4117e3b50531ef3d7cfa0c5459df85f7e5479eeb70863fd60451be6387fb3a3c2eb3b3abdb3551531c930294f31f265331e9d4ad70bc98f078e
SSDEEP

192:gvQqQLVXh8gaFLKlcMsDBe4dGTLlPG4pdAaTXdjjBxXp4eh6JhU89zvE4CP:gvaVmzFLNDDBe9TLlb7Xdjjrns+8tv0P

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4744-0-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3068	4744	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 4744	3580	rundll32.exe	83
PID 3580 wrote to memory of 4744	3580	rundll32.exe	83
PID 3580 wrote to memory of 4744	3580	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05dc4427882aef5cbd9530155fcaa988_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05dc4427882aef5cbd9530155fcaa988_JaffaCakes118.dll,#1
  2⤵
  PID:4744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 592
    3⤵
    - Program crash
    PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4744 -ip 4744
1⤵
PID:3592

memory/4744-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download