52f531db08dfc3b9df0b8a11749c8e1587cc84a457a21cc461580fb61748d7e2

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 07:33

Target

194b524af202bfb3fb3f2471b7762b59_JaffaCakes118.dll
Size

12KB
MD5

194b524af202bfb3fb3f2471b7762b59
SHA1

22792bc3fa804ba650866b9870cf1a3630651f50
SHA256

52f531db08dfc3b9df0b8a11749c8e1587cc84a457a21cc461580fb61748d7e2
SHA512

79e20ca89c2820e9b5a0a96a6d067b18887ecf2226361325a05318a210e38d947425b354ae3878a829eb76ec142d1555eaad0413137c7b2eb1d535226f175e66
SSDEEP

384:TjHEpIuwYMek9pSq8QHaNJawcudoD7UH:HkSuw3kRnbcuyD7U

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2900-0-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2960	2900	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2900	2888	rundll32.exe	28
PID 2888 wrote to memory of 2900	2888	rundll32.exe	28
PID 2888 wrote to memory of 2900	2888	rundll32.exe	28
PID 2888 wrote to memory of 2900	2888	rundll32.exe	28
PID 2888 wrote to memory of 2900	2888	rundll32.exe	28
PID 2888 wrote to memory of 2900	2888	rundll32.exe	28
PID 2888 wrote to memory of 2900	2888	rundll32.exe	28
PID 2900 wrote to memory of 2960	2900	rundll32.exe	29
PID 2900 wrote to memory of 2960	2900	rundll32.exe	29
PID 2900 wrote to memory of 2960	2900	rundll32.exe	29
PID 2900 wrote to memory of 2960	2900	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\194b524af202bfb3fb3f2471b7762b59_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\194b524af202bfb3fb3f2471b7762b59_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 244
    3⤵
    - Program crash
    PID:2960

memory/2900-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download