6c87af693ee43f8478bede7c3ba9b2d6286da189ce79c35eb6415d001af3c52c

Analysis

max time kernel
93s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 09:48

Target

34382637a2316617dd50d0bdfb2370aa_JaffaCakes118.dll
Size

57KB
MD5

34382637a2316617dd50d0bdfb2370aa
SHA1

fb0676421a8e15d6f7154a1ed14e8ac55764f0ab
SHA256

6c87af693ee43f8478bede7c3ba9b2d6286da189ce79c35eb6415d001af3c52c
SHA512

b0077557b1094ae45280e19428e1028c4f0450d4331398df519274c1bbeffb9a1965b8150fa33694b81885643460c5689030b5aaa08945ff76aed1bb520e3641
SSDEEP

768:4vbCoPHETfhxzLFFul7zw9I0nnCYACkHfTOu2yCfOEA4HyhqSo+lRQ8:YCTfhxLF89WI0nCYK/KlGEA4INR7

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1332-2-0x00000000009B0000-0x00000000009D9000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1468	1332	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1332	1688	regsvr32.exe	83
PID 1688 wrote to memory of 1332	1688	regsvr32.exe	83
PID 1688 wrote to memory of 1332	1688	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\34382637a2316617dd50d0bdfb2370aa_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\34382637a2316617dd50d0bdfb2370aa_JaffaCakes118.dll
  2⤵
  PID:1332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 644
    3⤵
    - Program crash
    PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1332 -ip 1332
1⤵
PID:2732

memory/1332-0-0x0000000010000000-0x0000000010004000-memory.dmp

Filesize
16KB

Download
memory/1332-1-0x0000000010001000-0x0000000010002000-memory.dmp

Filesize
4KB

Download
memory/1332-2-0x00000000009B0000-0x00000000009D9000-memory.dmp

Filesize
164KB

Download
memory/1332-4-0x0000000010000000-0x0000000010004000-memory.dmp

Filesize
16KB

Download