c5f23d201543f7c65cca0457896c6d0896f4d3a1a361153f930f3b6253ccb7b7

Analysis

max time kernel
93s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16bcdf5fe1524132d79b776958e577d6_JaffaCakes118.dll
Size

115KB
MD5

16bcdf5fe1524132d79b776958e577d6
SHA1

d71aef1da137cefb06aa7f45906e23ea3d39cec1
SHA256

c5f23d201543f7c65cca0457896c6d0896f4d3a1a361153f930f3b6253ccb7b7
SHA512

bc603ab4d85517de58878478bd054f2ecc2657462c6c577dba6ce3ede945ebf10fcc17b2f4f4a393c2cd22e285e8fe1d79b7439f0fb035d61540e457587883cf
SSDEEP

3072:biKXE79oAwOSxoPMVsf0nQla8vxgs2N+r3r:bDCRgPvSCsDr3r

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
452	3836	WerFault.exe	81

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 3836	2816	rundll32.exe	81
PID 2816 wrote to memory of 3836	2816	rundll32.exe	81
PID 2816 wrote to memory of 3836	2816	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16bcdf5fe1524132d79b776958e577d6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\16bcdf5fe1524132d79b776958e577d6_JaffaCakes118.dll,#1
  2⤵
  - Modifies registry class
  PID:3836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 620
    3⤵
    - Program crash
    PID:452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3836 -ip 3836
1⤵
PID:4524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3836-0-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/3836-1-0x0000000002DA0000-0x0000000002DCC000-memory.dmp

Filesize
176KB

Download
memory/3836-11-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

Filesize
4KB

Download
memory/3836-10-0x0000000002D80000-0x0000000002D81000-memory.dmp

Filesize
4KB

Download
memory/3836-9-0x0000000002F70000-0x0000000002F71000-memory.dmp

Filesize
4KB

Download
memory/3836-8-0x0000000002F30000-0x0000000002F31000-memory.dmp

Filesize
4KB

Download
memory/3836-7-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download
memory/3836-6-0x0000000002F40000-0x0000000002F41000-memory.dmp

Filesize
4KB

Download
memory/3836-5-0x0000000002F50000-0x0000000002F51000-memory.dmp

Filesize
4KB

Download
memory/3836-4-0x0000000002F60000-0x0000000002F61000-memory.dmp

Filesize
4KB

Download
memory/3836-3-0x0000000002D70000-0x0000000002D71000-memory.dmp

Filesize
4KB

Download
memory/3836-2-0x0000000002F90000-0x0000000002F91000-memory.dmp

Filesize
4KB

Download
memory/3836-17-0x00000000030A0000-0x00000000030A1000-memory.dmp

Filesize
4KB

Download
memory/3836-16-0x00000000030B0000-0x00000000030B1000-memory.dmp

Filesize
4KB

Download
memory/3836-15-0x0000000003080000-0x0000000003081000-memory.dmp

Filesize
4KB

Download
memory/3836-14-0x0000000003090000-0x0000000003091000-memory.dmp

Filesize
4KB

Download
memory/3836-13-0x0000000002FC0000-0x0000000002FC1000-memory.dmp

Filesize
4KB

Download
memory/3836-12-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

Filesize
4KB

Download
memory/3836-18-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/3836-19-0x0000000002DA0000-0x0000000002DCC000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads