fb8ecca612d8983893055c7f88d4b04d2ec6537541f659f5309bcae00f5b4d61

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 03:40

Target

24813cfacb90b12cfce776d4aa6dec53_JaffaCakes118.dll
Size

216KB
MD5

24813cfacb90b12cfce776d4aa6dec53
SHA1

8705bcb0b05ecaba94504de54578afaf847331bd
SHA256

fb8ecca612d8983893055c7f88d4b04d2ec6537541f659f5309bcae00f5b4d61
SHA512

86db55b0d26db23f2aab247a8b863464316939f9673f49f26a277b686db449519a0d620c90fd11c5e0d3605a3c9812152350cd4f4591bc6b47fac8af09187e13
SSDEEP

6144:uhrl1NWPLfVYF3xqEhNR7mYd+Y2oSHOgDu:ejWjVymYotoSH1u

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3180-0-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral2/memory/3180-1-0x0000000000400000-0x0000000000438000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3816	3180	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 3180	4648	regsvr32.exe	80
PID 4648 wrote to memory of 3180	4648	regsvr32.exe	80
PID 4648 wrote to memory of 3180	4648	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\24813cfacb90b12cfce776d4aa6dec53_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\24813cfacb90b12cfce776d4aa6dec53_JaffaCakes118.dll
  2⤵
  PID:3180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 660
    3⤵
    - Program crash
    PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3180 -ip 3180
1⤵
PID:3560

memory/3180-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3180-1-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download