Analysis
-
max time kernel
11s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 05:41
Static task
static1
Behavioral task
behavioral1
Sample
2f2b398b8856e4d33c2fa63a4af78143_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2f2b398b8856e4d33c2fa63a4af78143_JaffaCakes118.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240704-en
General
-
Target
$PLUGINSDIR/NSISdl.dll
-
Size
14KB
-
MD5
9c90c746adae5171c52b932080113331
-
SHA1
2eb66e61ad38a33aa6e6c245e84e0a78dfcc5460
-
SHA256
5b7be83ff4f023eba8d2d7ab972b067a904adc71f56a50cb367619cd116d0e92
-
SHA512
fca06b4b39fdd76002487a4f9a454bec5507b2355a0e4e2dfe044e2def52bbd01aa5d2a0077703f7b8814b248743fac2b84fd37f611e04281f7e5c428e245565
-
SSDEEP
192:wZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp/12VgsfA:wBo/680dCI5adOjFOg9//p27lAro
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 916 2552 WerFault.exe 29 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2552 2120 rundll32.exe 29 PID 2120 wrote to memory of 2552 2120 rundll32.exe 29 PID 2120 wrote to memory of 2552 2120 rundll32.exe 29 PID 2120 wrote to memory of 2552 2120 rundll32.exe 29 PID 2120 wrote to memory of 2552 2120 rundll32.exe 29 PID 2120 wrote to memory of 2552 2120 rundll32.exe 29 PID 2120 wrote to memory of 2552 2120 rundll32.exe 29 PID 2552 wrote to memory of 916 2552 rundll32.exe 30 PID 2552 wrote to memory of 916 2552 rundll32.exe 30 PID 2552 wrote to memory of 916 2552 rundll32.exe 30 PID 2552 wrote to memory of 916 2552 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 2283⤵
- Program crash
PID:916
-
-