89bee46c01af0cad561c3003ff6171dce6e5b46a4726afb79f6b1f31fd849abe

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 13:38

Target

34f2c17d9e90bd73ef67d23c9dc38655_JaffaCakes118.dll
Size

84KB
MD5

34f2c17d9e90bd73ef67d23c9dc38655
SHA1

0bd2edfd1682218028c592f1df50f5ba13c68b71
SHA256

89bee46c01af0cad561c3003ff6171dce6e5b46a4726afb79f6b1f31fd849abe
SHA512

18b6991e5450a8524a8c7c44d3f3a89ebfe2876ca31c3cf0c2b88b5ee43ff0f69eac28fee8bcefb5f779ae60441adf6472a3ddd3d17d989c12c739ed7ab1bbeb
SSDEEP

1536:uyjPZsKRXulEGSnfc8yx5xPD17zA0t5kXUV48T1k87H1k:uy7OOqEiXhnA0t5nrT6QVk

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2740-1-0x0000000000830000-0x0000000000861000-memory.dmp	upx
behavioral1/memory/2740-7-0x0000000000830000-0x0000000000861000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2700	2740	WerFault.exe	30

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\Registry\Machine\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2740	2688	regsvr32.exe	30
PID 2688 wrote to memory of 2740	2688	regsvr32.exe	30
PID 2688 wrote to memory of 2740	2688	regsvr32.exe	30
PID 2688 wrote to memory of 2740	2688	regsvr32.exe	30
PID 2688 wrote to memory of 2740	2688	regsvr32.exe	30
PID 2688 wrote to memory of 2740	2688	regsvr32.exe	30
PID 2688 wrote to memory of 2740	2688	regsvr32.exe	30
PID 2740 wrote to memory of 2700	2740	regsvr32.exe	31
PID 2740 wrote to memory of 2700	2740	regsvr32.exe	31
PID 2740 wrote to memory of 2700	2740	regsvr32.exe	31
PID 2740 wrote to memory of 2700	2740	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\34f2c17d9e90bd73ef67d23c9dc38655_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\34f2c17d9e90bd73ef67d23c9dc38655_JaffaCakes118.dll
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 312
    3⤵
    - Program crash
    PID:2700

memory/2740-0-0x00000000001D0000-0x0000000000205000-memory.dmp

Filesize
212KB

Download
memory/2740-1-0x0000000000830000-0x0000000000861000-memory.dmp

Filesize
196KB

Download
memory/2740-3-0x0000000000870000-0x00000000008A5000-memory.dmp

Filesize
212KB

Download
memory/2740-7-0x0000000000830000-0x0000000000861000-memory.dmp

Filesize
196KB

Download
memory/2740-8-0x00000000001D0000-0x0000000000205000-memory.dmp

Filesize
212KB

Download