232854939bb997566089b4c2dbe2f26c061d84ed535dd747e743f60c5015f6ce

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 08:21

Target

154d4748099a84f331304e8fe79afd0e_JaffaCakes118.dll
Size

216KB
MD5

154d4748099a84f331304e8fe79afd0e
SHA1

ae8ca2986bc41c69d12edd881ea9af28e488d2f0
SHA256

232854939bb997566089b4c2dbe2f26c061d84ed535dd747e743f60c5015f6ce
SHA512

4a941f4f01159b417436515c52c732465edf22ad43469730199fca98a1eabb3e9527bb8979868159e6f67ee90fa6698f73bc4e1d39572cab6d8fd4e55c390b21
SSDEEP

6144:+hrl1NWPLfVYF3xqEhNR7mYd+Y2oSiOgK:OjWjVymYotoSic

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2348-2-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/memory/2348-0-0x00000000002C0000-0x00000000002F8000-memory.dmp	upx
behavioral1/memory/2348-5-0x0000000000400000-0x0000000000438000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1028	2348	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2348	2328	regsvr32.exe	28
PID 2328 wrote to memory of 2348	2328	regsvr32.exe	28
PID 2328 wrote to memory of 2348	2328	regsvr32.exe	28
PID 2328 wrote to memory of 2348	2328	regsvr32.exe	28
PID 2328 wrote to memory of 2348	2328	regsvr32.exe	28
PID 2328 wrote to memory of 2348	2328	regsvr32.exe	28
PID 2328 wrote to memory of 2348	2328	regsvr32.exe	28
PID 2348 wrote to memory of 1028	2348	regsvr32.exe	29
PID 2348 wrote to memory of 1028	2348	regsvr32.exe	29
PID 2348 wrote to memory of 1028	2348	regsvr32.exe	29
PID 2348 wrote to memory of 1028	2348	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\154d4748099a84f331304e8fe79afd0e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\154d4748099a84f331304e8fe79afd0e_JaffaCakes118.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 320
    3⤵
    - Program crash
    PID:1028

memory/2348-2-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2348-0-0x00000000002C0000-0x00000000002F8000-memory.dmp

Filesize
224KB

Download
memory/2348-3-0x00000000024E0000-0x00000000025F0000-memory.dmp

Filesize
1.1MB

Download
memory/2348-5-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download