4392b540e76a9f5f48424e5bc589f958a4425293374068dbd4fec0275a132a21

Analysis

max time kernel
133s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 08:47

Target

21c1616a67aa89ce66655a97dc240c9e_JaffaCakes118.dll
Size

168KB
MD5

21c1616a67aa89ce66655a97dc240c9e
SHA1

7fbd6478da0b6e6cdb4e2e1f3174224c6337dfbd
SHA256

4392b540e76a9f5f48424e5bc589f958a4425293374068dbd4fec0275a132a21
SHA512

19a8d0131a8ec00b0895a326c2687d4a1b5b19c8724293025d7da2cd4a55a1d4de1ab50747bb1a296740d431d7268306b7243e0eded9e235895aa4343f47dd2f
SSDEEP

3072:e1CBjTbN7xBQs9GcmbQzNsGoC/bKLhu7CC0JFn2sCjmv2out8:ekJHNVB1BE+N9rjKw7CtH2svv2oS

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4808-0-0x0000000000400000-0x0000000000447000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2776	4808	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 4808	4520	rundll32.exe	89
PID 4520 wrote to memory of 4808	4520	rundll32.exe	89
PID 4520 wrote to memory of 4808	4520	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21c1616a67aa89ce66655a97dc240c9e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21c1616a67aa89ce66655a97dc240c9e_JaffaCakes118.dll,#1
  2⤵
  PID:4808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 568
    3⤵
    - Program crash
    PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4808 -ip 4808
1⤵
PID:3276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1420,i,17949988676391029604,13756926835471203788,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:8
1⤵
PID:3124

memory/4808-0-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4808-1-0x0000000000DD0000-0x0000000000DE4000-memory.dmp

Filesize
80KB

Download