13815a2db1aef308f2be66b674a9c3dd166390ead36a4aea6707aa2a2d79cd96

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 16:38

Target

09a4d05a2a42191f93c0f78a92b766e3_JaffaCakes118.dll
Size

548KB
MD5

09a4d05a2a42191f93c0f78a92b766e3
SHA1

086a836c6c3a06fa6246fa4532f8d0b647e1e40b
SHA256

13815a2db1aef308f2be66b674a9c3dd166390ead36a4aea6707aa2a2d79cd96
SHA512

e5d30c46207118edb786e251869bd5e9bd87e63433a76febbc01332beb0e888c388e89ce48daa552a1b3b10c8ace802e72ad114f225c227a4bb96449429cbcf2
SSDEEP

12288:b64aIkqLJ6ajedvbHAimByOtm5O+PVLURYkiEWvfoS:b6iZ6VjCp+PayoW

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2320-0-0x00000000022D0000-0x00000000024BC000-memory.dmp	upx
behavioral2/memory/2320-1-0x00000000022D0000-0x00000000024BC000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
800	2320	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 2320	3760	rundll32.exe	81
PID 3760 wrote to memory of 2320	3760	rundll32.exe	81
PID 3760 wrote to memory of 2320	3760	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09a4d05a2a42191f93c0f78a92b766e3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09a4d05a2a42191f93c0f78a92b766e3_JaffaCakes118.dll,#1
  2⤵
  PID:2320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 548
    3⤵
    - Program crash
    PID:800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2320 -ip 2320
1⤵
PID:4220

memory/2320-0-0x00000000022D0000-0x00000000024BC000-memory.dmp

Filesize
1.9MB

Download
memory/2320-1-0x00000000022D0000-0x00000000024BC000-memory.dmp

Filesize
1.9MB

Download