89bee46c01af0cad561c3003ff6171dce6e5b46a4726afb79f6b1f31fd849abe

Analysis

max time kernel
93s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 13:38

Target

34f2c17d9e90bd73ef67d23c9dc38655_JaffaCakes118.dll
Size

84KB
MD5

34f2c17d9e90bd73ef67d23c9dc38655
SHA1

0bd2edfd1682218028c592f1df50f5ba13c68b71
SHA256

89bee46c01af0cad561c3003ff6171dce6e5b46a4726afb79f6b1f31fd849abe
SHA512

18b6991e5450a8524a8c7c44d3f3a89ebfe2876ca31c3cf0c2b88b5ee43ff0f69eac28fee8bcefb5f779ae60441adf6472a3ddd3d17d989c12c739ed7ab1bbeb
SSDEEP

1536:uyjPZsKRXulEGSnfc8yx5xPD17zA0t5kXUV48T1k87H1k:uy7OOqEiXhnA0t5nrT6QVk

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3340-1-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/3340-7-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/3340-9-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1284	3340	WerFault.exe	83

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\	regsvr32.exe
Key created	\Registry\Machine\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 3340	5112	regsvr32.exe	83
PID 5112 wrote to memory of 3340	5112	regsvr32.exe	83
PID 5112 wrote to memory of 3340	5112	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\34f2c17d9e90bd73ef67d23c9dc38655_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\34f2c17d9e90bd73ef67d23c9dc38655_JaffaCakes118.dll
  2⤵
  - Modifies registry class
  PID:3340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 636
    3⤵
    - Program crash
    PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3340 -ip 3340
1⤵
PID:3956

memory/3340-0-0x0000000000540000-0x0000000000575000-memory.dmp

Filesize
212KB

Download
memory/3340-1-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3340-2-0x00000000029D0000-0x0000000002A05000-memory.dmp

Filesize
212KB

Download
memory/3340-7-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3340-8-0x0000000000540000-0x0000000000575000-memory.dmp

Filesize
212KB

Download
memory/3340-9-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download