52f531db08dfc3b9df0b8a11749c8e1587cc84a457a21cc461580fb61748d7e2

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 07:33

Target

194b524af202bfb3fb3f2471b7762b59_JaffaCakes118.dll
Size

12KB
MD5

194b524af202bfb3fb3f2471b7762b59
SHA1

22792bc3fa804ba650866b9870cf1a3630651f50
SHA256

52f531db08dfc3b9df0b8a11749c8e1587cc84a457a21cc461580fb61748d7e2
SHA512

79e20ca89c2820e9b5a0a96a6d067b18887ecf2226361325a05318a210e38d947425b354ae3878a829eb76ec142d1555eaad0413137c7b2eb1d535226f175e66
SSDEEP

384:TjHEpIuwYMek9pSq8QHaNJawcudoD7UH:HkSuw3kRnbcuyD7U

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1416-0-0x0000000010000000-0x000000001000C000-memory.dmp	upx
behavioral2/memory/1416-1-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	1416	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 1416	1320	rundll32.exe	88
PID 1320 wrote to memory of 1416	1320	rundll32.exe	88
PID 1320 wrote to memory of 1416	1320	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\194b524af202bfb3fb3f2471b7762b59_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\194b524af202bfb3fb3f2471b7762b59_JaffaCakes118.dll,#1
  2⤵
  PID:1416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 632
    3⤵
    - Program crash
    PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1416 -ip 1416
1⤵
PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4196,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
1⤵
PID:2992

memory/1416-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/1416-1-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download