c180e6e9aac33a0c60c03852269d98a88c77873717ccba014b3dcb6e090e812a

Analysis

max time kernel
143s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/07/2024, 23:17

Target

2a228c2c5e077030d1f509e31df5e78d_JaffaCakes118.dll
Size

122KB
MD5

2a228c2c5e077030d1f509e31df5e78d
SHA1

9feb2f6d11414d7c58d1638f4dff3c2011264771
SHA256

c180e6e9aac33a0c60c03852269d98a88c77873717ccba014b3dcb6e090e812a
SHA512

edc40dadd6d52e5b4b19aebfe3a17cf7be8e2537e3a7f7673939605ef461ada87ccaa7610876dfc5c5839470f118f0264a8162366bcf9fb4057306105ca80c04
SSDEEP

3072:oSYPZR6H/EBTXL2fXFBx/9U4i7OkZSokAv5/ix:ofR6fE5IXHxnjk5/

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/888-4-0x00000000002A0000-0x00000000002EC000-memory.dmp	upx
behavioral1/memory/888-5-0x00000000002A0000-0x00000000002EC000-memory.dmp	upx
behavioral1/memory/888-8-0x00000000002A0000-0x00000000002EC000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2724	888	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 888	2504	rundll32.exe	29
PID 2504 wrote to memory of 888	2504	rundll32.exe	29
PID 2504 wrote to memory of 888	2504	rundll32.exe	29
PID 2504 wrote to memory of 888	2504	rundll32.exe	29
PID 2504 wrote to memory of 888	2504	rundll32.exe	29
PID 2504 wrote to memory of 888	2504	rundll32.exe	29
PID 2504 wrote to memory of 888	2504	rundll32.exe	29
PID 888 wrote to memory of 2724	888	rundll32.exe	30
PID 888 wrote to memory of 2724	888	rundll32.exe	30
PID 888 wrote to memory of 2724	888	rundll32.exe	30
PID 888 wrote to memory of 2724	888	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a228c2c5e077030d1f509e31df5e78d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a228c2c5e077030d1f509e31df5e78d_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 204
    3⤵
    - Program crash
    PID:2724

memory/888-3-0x00000000001B0000-0x00000000001FF000-memory.dmp

Filesize
316KB

Download
memory/888-2-0x00000000001A0000-0x00000000001EF000-memory.dmp

Filesize
316KB

Download
memory/888-1-0x00000000001A0000-0x00000000001EF000-memory.dmp

Filesize
316KB

Download
memory/888-0-0x00000000001A0000-0x00000000001EF000-memory.dmp

Filesize
316KB

Download
memory/888-4-0x00000000002A0000-0x00000000002EC000-memory.dmp

Filesize
304KB

Download
memory/888-5-0x00000000002A0000-0x00000000002EC000-memory.dmp

Filesize
304KB

Download
memory/888-6-0x00000000001B0000-0x00000000001FF000-memory.dmp

Filesize
316KB

Download
memory/888-8-0x00000000002A0000-0x00000000002EC000-memory.dmp

Filesize
304KB

Download