69f4fb40864f687469e34715489a33e3c15b7088855c4de1df030d39af3d424b

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 17:13

Target

2329ae9cd6c15902994dca5d1887458e_JaffaCakes118.dll
Size

216KB
MD5

2329ae9cd6c15902994dca5d1887458e
SHA1

8e525a13c932a382b348ebf937cd630fdb3a102a
SHA256

69f4fb40864f687469e34715489a33e3c15b7088855c4de1df030d39af3d424b
SHA512

8b240a9f27f1d61f3e90d2f7fcf8856d196bed9b46e5259fd349ee428133e3db3b91abeeda00f77b44f8dac1dceea006ee4b67b7d3c342040fc4a067bfcb5be9
SSDEEP

6144:vhrl1NWPLfVYF3xqEhNR7mYd+Y2oS7OgH:jjWjVymYotoS7d

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1728-0-0x00000000001F0000-0x0000000000228000-memory.dmp	upx
behavioral1/memory/1728-2-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/memory/1728-5-0x0000000000400000-0x0000000000438000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2160	1728	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 1728	348	regsvr32.exe	28
PID 348 wrote to memory of 1728	348	regsvr32.exe	28
PID 348 wrote to memory of 1728	348	regsvr32.exe	28
PID 348 wrote to memory of 1728	348	regsvr32.exe	28
PID 348 wrote to memory of 1728	348	regsvr32.exe	28
PID 348 wrote to memory of 1728	348	regsvr32.exe	28
PID 348 wrote to memory of 1728	348	regsvr32.exe	28
PID 1728 wrote to memory of 2160	1728	regsvr32.exe	29
PID 1728 wrote to memory of 2160	1728	regsvr32.exe	29
PID 1728 wrote to memory of 2160	1728	regsvr32.exe	29
PID 1728 wrote to memory of 2160	1728	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2329ae9cd6c15902994dca5d1887458e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:348
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2329ae9cd6c15902994dca5d1887458e_JaffaCakes118.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 320
    3⤵
    - Program crash
    PID:2160

memory/1728-0-0x00000000001F0000-0x0000000000228000-memory.dmp

Filesize
224KB

Download
memory/1728-2-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1728-3-0x0000000000D20000-0x0000000000E30000-memory.dmp

Filesize
1.1MB

Download
memory/1728-5-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download