e6e445e31f3655ec1bd32ff2fdeb3fe8771e89f3e2b1fff4353282e1fe6ed61c

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 22:15

Target

2e01bd93f4518c5245947af7170c083d_JaffaCakes118.dll
Size

11KB
MD5

2e01bd93f4518c5245947af7170c083d
SHA1

eea314028f0b583e9b0aeb9c76757ab77fe72dd6
SHA256

e6e445e31f3655ec1bd32ff2fdeb3fe8771e89f3e2b1fff4353282e1fe6ed61c
SHA512

954b5f431ef132f0c4d0553682b931e49748ca1e56b4aa1249e45f8609d115c6a21c335c3dcf88e526c45a83d9fb589340ba631553d25c14727dcc7d1fd86735
SSDEEP

192:Jv4uOV33shlvMhqrPw+2/Pug+0QKB3d0enghp4bZj0h0o+r3:Jv4uZldr9oPQmgyla0oC3

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1016-0-0x0000000010000000-0x000000001000B000-memory.dmp	upx
behavioral1/memory/1016-1-0x0000000010000000-0x000000001000B000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
904	1016	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 1016	2316	rundll32.exe	30
PID 2316 wrote to memory of 1016	2316	rundll32.exe	30
PID 2316 wrote to memory of 1016	2316	rundll32.exe	30
PID 2316 wrote to memory of 1016	2316	rundll32.exe	30
PID 2316 wrote to memory of 1016	2316	rundll32.exe	30
PID 2316 wrote to memory of 1016	2316	rundll32.exe	30
PID 2316 wrote to memory of 1016	2316	rundll32.exe	30
PID 1016 wrote to memory of 904	1016	rundll32.exe	31
PID 1016 wrote to memory of 904	1016	rundll32.exe	31
PID 1016 wrote to memory of 904	1016	rundll32.exe	31
PID 1016 wrote to memory of 904	1016	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e01bd93f4518c5245947af7170c083d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e01bd93f4518c5245947af7170c083d_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 244
    3⤵
    - Program crash
    PID:904

memory/1016-0-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/1016-1-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download