6bebd89e1baa4ba1b39e89e140f6cac87d942a6d3b01030527dbd31bcba11be2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 17:32

Target

09de9b9cebac7fc1bf9ce6fcc719b959_JaffaCakes118.dll
Size

9KB
MD5

09de9b9cebac7fc1bf9ce6fcc719b959
SHA1

e9c263ffe09a5e6056ac576f7d41bda8da230df4
SHA256

6bebd89e1baa4ba1b39e89e140f6cac87d942a6d3b01030527dbd31bcba11be2
SHA512

2f5e8547d3ba3382e8475c90d0b409a35fcd9ca4fe4f2132c9e25f49db8de5ee3c427e6d147450c31f0f2a44153db76ffa9572ceee94cee282a64adf762d8c00
SSDEEP

192:bW33geD+8vKt7oMdP8qPu+TqcxHz1K3a5+mA:iweD+4KxHuCq6T1Kf

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5000-0-0x0000000025000000-0x0000000025011000-memory.dmp	upx
behavioral2/memory/5000-2-0x0000000025000000-0x0000000025011000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4024	5000	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 5000	2404	rundll32.exe	82
PID 2404 wrote to memory of 5000	2404	rundll32.exe	82
PID 2404 wrote to memory of 5000	2404	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09de9b9cebac7fc1bf9ce6fcc719b959_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09de9b9cebac7fc1bf9ce6fcc719b959_JaffaCakes118.dll,#1
  2⤵
  PID:5000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 720
    3⤵
    - Program crash
    PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5000 -ip 5000
1⤵
PID:4032

memory/5000-0-0x0000000025000000-0x0000000025011000-memory.dmp

Filesize
68KB

Download
memory/5000-2-0x0000000025000000-0x0000000025011000-memory.dmp

Filesize
68KB

Download