fb8ecca612d8983893055c7f88d4b04d2ec6537541f659f5309bcae00f5b4d61

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 03:40

Target

24813cfacb90b12cfce776d4aa6dec53_JaffaCakes118.dll
Size

216KB
MD5

24813cfacb90b12cfce776d4aa6dec53
SHA1

8705bcb0b05ecaba94504de54578afaf847331bd
SHA256

fb8ecca612d8983893055c7f88d4b04d2ec6537541f659f5309bcae00f5b4d61
SHA512

86db55b0d26db23f2aab247a8b863464316939f9673f49f26a277b686db449519a0d620c90fd11c5e0d3605a3c9812152350cd4f4591bc6b47fac8af09187e13
SSDEEP

6144:uhrl1NWPLfVYF3xqEhNR7mYd+Y2oSHOgDu:ejWjVymYotoSH1u

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2860-1-0x0000000000390000-0x00000000003C8000-memory.dmp	upx
behavioral1/memory/2860-2-0x00000000001B0000-0x00000000001E8000-memory.dmp	upx
behavioral1/memory/2860-5-0x00000000001B0000-0x00000000001E8000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2600	2860	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2860	2236	regsvr32.exe	28
PID 2236 wrote to memory of 2860	2236	regsvr32.exe	28
PID 2236 wrote to memory of 2860	2236	regsvr32.exe	28
PID 2236 wrote to memory of 2860	2236	regsvr32.exe	28
PID 2236 wrote to memory of 2860	2236	regsvr32.exe	28
PID 2236 wrote to memory of 2860	2236	regsvr32.exe	28
PID 2236 wrote to memory of 2860	2236	regsvr32.exe	28
PID 2860 wrote to memory of 2600	2860	regsvr32.exe	29
PID 2860 wrote to memory of 2600	2860	regsvr32.exe	29
PID 2860 wrote to memory of 2600	2860	regsvr32.exe	29
PID 2860 wrote to memory of 2600	2860	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\24813cfacb90b12cfce776d4aa6dec53_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\24813cfacb90b12cfce776d4aa6dec53_JaffaCakes118.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 324
    3⤵
    - Program crash
    PID:2600

memory/2860-1-0x0000000000390000-0x00000000003C8000-memory.dmp

Filesize
224KB

Download
memory/2860-2-0x00000000001B0000-0x00000000001E8000-memory.dmp

Filesize
224KB

Download
memory/2860-3-0x00000000020B0000-0x00000000021C0000-memory.dmp

Filesize
1.1MB

Download
memory/2860-5-0x00000000001B0000-0x00000000001E8000-memory.dmp

Filesize
224KB

Download