ce3ffd5a862d1b849e8f519411da8d65d9c2191d5d44eace18d8a4d8df02cfa3

Analysis

max time kernel
132s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1400cb75c0ed0a8b48d46e4bac330c92_JaffaCakes118.dll
Size 324KB
Sample240627-albbqasbmb
SHA256 ce3ffd5a862d1b849e8f519411da8d65d9c2191d5d44eace18d8a4d8df02cfa3
MD5 1400cb75c0ed0a8b48d46e4bac330c92
SHA1 169ad20924e7daeb53a3fb862b0f7d0f715e7b85
SHA512 01c7b9d1103a17ed8b8ab060166fe4edc964a3672c120d1288bd8b7aee00e5680a927a654e522a6467e2a00a6f6fe14537c75d6a8951751128dcfe83156cab22
SSDEEP 6144:y5LUFivUFuJfn39Ta319VqjW+Z8MD2LNze74//F919:y5vvqmn39TafIbZ8MYz6219
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
212	rundll32mgr.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00060000000233cd-3.dat	upx
behavioral2/memory/212-5-0x0000000000400000-0x0000000000456000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3012	212	WerFault.exe	84

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 1768	1828	rundll32.exe	83
PID 1828 wrote to memory of 1768	1828	rundll32.exe	83
PID 1828 wrote to memory of 1768	1828	rundll32.exe	83
PID 1768 wrote to memory of 212	1768	rundll32.exe	84
PID 1768 wrote to memory of 212	1768	rundll32.exe	84
PID 1768 wrote to memory of 212	1768	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1400cb75c0ed0a8b48d46e4bac330c92_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1400cb75c0ed0a8b48d46e4bac330c92_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    PID:212
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 264
      4⤵
      Program crash
      PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 212 -ip 212
1⤵
PID:4136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

rundll32mgr.exe

Path C:\Windows\SysWOW64\rundll32mgr.exe
Size 104KB
SHA256 b26a93c17ac6a412c6c191aa6a1543537f3185fe813c24153c6dec736fbad4ef
MD5 84b7783804fa7506672a409e9899c6be
SHA1 2da8a6e9c04662564e18cdf98f73e224a5662533
SHA512 8a867296b05f45dd79ab64b11b6cc0cc8fad835b2f5ba9b8469981cc9b3e15c91f98b688cbe7addfab7ea2bd55a1d475fc853c004afb24be1b5691f8183c897c
SSDEEP 1536:sLOC0FvV4OguHxjhpA4Bm7uW0vSUsghQevBFkutIbgTuFqKRr0aF5frleGhd9Tfo:YwV4OgSzBmh04eZFkz3Rr0gwGj9Tf8l
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-6-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/212-5-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/1768-1-0x0000000010000000-0x0000000010053000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads