232854939bb997566089b4c2dbe2f26c061d84ed535dd747e743f60c5015f6ce

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 08:21

Target

154d4748099a84f331304e8fe79afd0e_JaffaCakes118.dll
Size

216KB
MD5

154d4748099a84f331304e8fe79afd0e
SHA1

ae8ca2986bc41c69d12edd881ea9af28e488d2f0
SHA256

232854939bb997566089b4c2dbe2f26c061d84ed535dd747e743f60c5015f6ce
SHA512

4a941f4f01159b417436515c52c732465edf22ad43469730199fca98a1eabb3e9527bb8979868159e6f67ee90fa6698f73bc4e1d39572cab6d8fd4e55c390b21
SSDEEP

6144:+hrl1NWPLfVYF3xqEhNR7mYd+Y2oSiOgK:OjWjVymYotoSic

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1388-0-0x0000000001110000-0x0000000001148000-memory.dmp	upx
behavioral2/memory/1388-1-0x0000000001110000-0x0000000001148000-memory.dmp	upx
behavioral2/memory/1388-2-0x0000000001110000-0x0000000001148000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2456	1388	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 1388	1548	regsvr32.exe	81
PID 1548 wrote to memory of 1388	1548	regsvr32.exe	81
PID 1548 wrote to memory of 1388	1548	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\154d4748099a84f331304e8fe79afd0e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\154d4748099a84f331304e8fe79afd0e_JaffaCakes118.dll
  2⤵
  PID:1388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 660
    3⤵
    - Program crash
    PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1388 -ip 1388
1⤵
PID:4160

memory/1388-0-0x0000000001110000-0x0000000001148000-memory.dmp

Filesize
224KB

Download
memory/1388-1-0x0000000001110000-0x0000000001148000-memory.dmp

Filesize
224KB

Download
memory/1388-2-0x0000000001110000-0x0000000001148000-memory.dmp

Filesize
224KB

Download