cdd4dd02c02502672a4a6b0e26143e4961ef48f3d031de1bec547e4c29a6b4ea

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 04:09

Target

210780589173c02178b320663d763810_JaffaCakes118.dll
Size

1.1MB
MD5

210780589173c02178b320663d763810
SHA1

6ef6d164d5866ed51498f05238ce62bf9c8e8983
SHA256

cdd4dd02c02502672a4a6b0e26143e4961ef48f3d031de1bec547e4c29a6b4ea
SHA512

6e3a3ffcb7a46c2bfc54b5553964ff4d2f67cdf438b149b9b4047ac936bc08113c3638400a0b102fc67a22adafdd115471a11793febe021723174c998ede02da
SSDEEP

12288:MMpc1kF6rPOAD5k5aFU86fdVEt5EU0PqbZPMgzh:ve1dJD5k5aFUdfd8EU065p

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1636-0-0x0000000010000000-0x00000000101FC000-memory.dmp	upx
behavioral1/memory/1636-1-0x0000000010000000-0x00000000101FC000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2088	1636	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 1636	2768	rundll32.exe	28
PID 2768 wrote to memory of 1636	2768	rundll32.exe	28
PID 2768 wrote to memory of 1636	2768	rundll32.exe	28
PID 2768 wrote to memory of 1636	2768	rundll32.exe	28
PID 2768 wrote to memory of 1636	2768	rundll32.exe	28
PID 2768 wrote to memory of 1636	2768	rundll32.exe	28
PID 2768 wrote to memory of 1636	2768	rundll32.exe	28
PID 1636 wrote to memory of 2088	1636	rundll32.exe	29
PID 1636 wrote to memory of 2088	1636	rundll32.exe	29
PID 1636 wrote to memory of 2088	1636	rundll32.exe	29
PID 1636 wrote to memory of 2088	1636	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\210780589173c02178b320663d763810_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\210780589173c02178b320663d763810_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 244
    3⤵
    - Program crash
    PID:2088

memory/1636-0-0x0000000010000000-0x00000000101FC000-memory.dmp

Filesize
2.0MB

Download
memory/1636-1-0x0000000010000000-0x00000000101FC000-memory.dmp

Filesize
2.0MB

Download