Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 06:29
Static task
static1
Behavioral task
behavioral1
Sample
33a761dbe5930c762f7f88f7d733a7fe_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
33a761dbe5930c762f7f88f7d733a7fe_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
8d144.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
8d144.dll
Resource
win10v2004-20240709-en
General
-
Target
8d144.dll
-
Size
10KB
-
MD5
fcaca1b9ad5fe0bfed523839d37ecf27
-
SHA1
66fdce05606bc861b42fec41b0505668ac21defe
-
SHA256
3f36bb6084f358696601a687bee93c006bdbb4155a16603ad350d83093a94417
-
SHA512
41b2144eef175e61a9dc417dd8556f653268584ef82c44132b2d505f00dad488dffce370beffeabf322ecf8cfa3cdad6f80b7f3fab8e0a29941aafe77e9c564c
-
SSDEEP
192:WLk0vuR9jECxj2EFlr9fKxGxWifbv32LZgEJ:WHGbjdp2KrhKIUizv32LZ
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2148 2356 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
rundll32.exepid process 2356 rundll32.exe 2356 rundll32.exe 2356 rundll32.exe 2356 rundll32.exe 2356 rundll32.exe 2356 rundll32.exe 2356 rundll32.exe 2356 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2296 wrote to memory of 2356 2296 rundll32.exe rundll32.exe PID 2296 wrote to memory of 2356 2296 rundll32.exe rundll32.exe PID 2296 wrote to memory of 2356 2296 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8d144.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8d144.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:2356 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 6723⤵
- Program crash
PID:2148
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2356 -ip 23561⤵PID:1924