f819afd2bb52f1cb5a41a5726f74f96f6238c9801000e56b3c9c0afb69b5962d

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 16:30

Target

31214493720564b5f531720bb8d281de_JaffaCakes118.dll
Size

88KB
MD5

31214493720564b5f531720bb8d281de
SHA1

fc9d3db8af69eccd3114abc12e75c1e4dc43f4c8
SHA256

f819afd2bb52f1cb5a41a5726f74f96f6238c9801000e56b3c9c0afb69b5962d
SHA512

9d5cc7cd0933387cffe81f566930af6d67b1d5101299356bafe4765cb3bbb9be58a3c5dd2125cf44ec571be009b093d32650a603eaff1180e64c68d8564affbf
SSDEEP

1536:M4Z6tEk8Y2tfIrBwQQReDAOq8QVQXdW2uwLneXSStBa1WiEldnouy8dd:JZ9kcSwQWyAOq8QVQs2nLKe1WRHoutdd

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1820-0-0x0000000010000000-0x0000000010025000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1344	1820	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 1820	4028	rundll32.exe	80
PID 4028 wrote to memory of 1820	4028	rundll32.exe	80
PID 4028 wrote to memory of 1820	4028	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31214493720564b5f531720bb8d281de_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31214493720564b5f531720bb8d281de_JaffaCakes118.dll,#1
  2⤵
  PID:1820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 568
    3⤵
    - Program crash
    PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1820 -ip 1820
1⤵
PID:4004

memory/1820-0-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download