e6e445e31f3655ec1bd32ff2fdeb3fe8771e89f3e2b1fff4353282e1fe6ed61c

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 22:15

Target

2e01bd93f4518c5245947af7170c083d_JaffaCakes118.dll
Size

11KB
MD5

2e01bd93f4518c5245947af7170c083d
SHA1

eea314028f0b583e9b0aeb9c76757ab77fe72dd6
SHA256

e6e445e31f3655ec1bd32ff2fdeb3fe8771e89f3e2b1fff4353282e1fe6ed61c
SHA512

954b5f431ef132f0c4d0553682b931e49748ca1e56b4aa1249e45f8609d115c6a21c335c3dcf88e526c45a83d9fb589340ba631553d25c14727dcc7d1fd86735
SSDEEP

192:Jv4uOV33shlvMhqrPw+2/Pug+0QKB3d0enghp4bZj0h0o+r3:Jv4uZldr9oPQmgyla0oC3

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3092-0-0x0000000010000000-0x000000001000B000-memory.dmp	upx
behavioral2/memory/3092-2-0x0000000010000000-0x000000001000B000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3164	3092	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 3092	1500	rundll32.exe	82
PID 1500 wrote to memory of 3092	1500	rundll32.exe	82
PID 1500 wrote to memory of 3092	1500	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e01bd93f4518c5245947af7170c083d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e01bd93f4518c5245947af7170c083d_JaffaCakes118.dll,#1
  2⤵
  PID:3092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 632
    3⤵
    - Program crash
    PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3092 -ip 3092
1⤵
PID:3648

memory/3092-0-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/3092-2-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download