c180e6e9aac33a0c60c03852269d98a88c77873717ccba014b3dcb6e090e812a

Analysis

max time kernel
125s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 23:17

Target

2a228c2c5e077030d1f509e31df5e78d_JaffaCakes118.dll
Size

122KB
MD5

2a228c2c5e077030d1f509e31df5e78d
SHA1

9feb2f6d11414d7c58d1638f4dff3c2011264771
SHA256

c180e6e9aac33a0c60c03852269d98a88c77873717ccba014b3dcb6e090e812a
SHA512

edc40dadd6d52e5b4b19aebfe3a17cf7be8e2537e3a7f7673939605ef461ada87ccaa7610876dfc5c5839470f118f0264a8162366bcf9fb4057306105ca80c04
SSDEEP

3072:oSYPZR6H/EBTXL2fXFBx/9U4i7OkZSokAv5/ix:ofR6fE5IXHxnjk5/

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1640-1-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/1640-2-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/1640-5-0x0000000000400000-0x000000000044C000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4024	1640	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1640	2008	rundll32.exe	89
PID 2008 wrote to memory of 1640	2008	rundll32.exe	89
PID 2008 wrote to memory of 1640	2008	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a228c2c5e077030d1f509e31df5e78d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a228c2c5e077030d1f509e31df5e78d_JaffaCakes118.dll,#1
  2⤵
  PID:1640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 576
    3⤵
    - Program crash
    PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1640 -ip 1640
1⤵
PID:4864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4208,i,7362247189940554640,1583793531684159627,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:8
1⤵
PID:3804

memory/1640-0-0x0000000000550000-0x000000000059F000-memory.dmp

Filesize
316KB

Download
memory/1640-1-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1640-2-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1640-3-0x0000000000550000-0x000000000059F000-memory.dmp

Filesize
316KB

Download
memory/1640-5-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download