c4b587d143c9f50e103424e3986337340a57af3b2fb8ade415cf1b6c9e1ea52f

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 16:01

Target

2705258af2bcef091a4db72ae2d3c199_JaffaCakes118.dll
Size

33KB
MD5

2705258af2bcef091a4db72ae2d3c199
SHA1

e996ab9d31ecd17fd098c40d9b768060a2519cac
SHA256

c4b587d143c9f50e103424e3986337340a57af3b2fb8ade415cf1b6c9e1ea52f
SHA512

5d7b518f756c34a7b02eec0c826448793f13bad790e69ec1b2e5ec4e5b889cdc9cfe5306f196067f2f73b48a15b2877fe8ef02fa60b31ed28c17dac4ee829993
SSDEEP

768:MbU4okz7NW1N0PmVB8VBZ4HHhs2Q4Mra0nbcuyD7Uc1A/Y:MbXvNW1CmB8/STMnouy8c1AA

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4132-0-0x0000000010000000-0x0000000010019000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4076	4132	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 4132	2816	rundll32.exe	82
PID 2816 wrote to memory of 4132	2816	rundll32.exe	82
PID 2816 wrote to memory of 4132	2816	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2705258af2bcef091a4db72ae2d3c199_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2705258af2bcef091a4db72ae2d3c199_JaffaCakes118.dll,#1
  2⤵
  PID:4132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 568
    3⤵
    - Program crash
    PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4132 -ip 4132
1⤵
PID:2868

memory/4132-0-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download