80ccb4a6fd001b72e733901b689b341c011780b130a1c3589f3fce63cf06c5b4

Analysis

max time kernel
141s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 16:28

Target

35809d5f8d1ea9c7ea598bf50499881b_JaffaCakes118.dll
Size

22KB
MD5

35809d5f8d1ea9c7ea598bf50499881b
SHA1

4e43fc0b26541b2560bd95c25bbd1acad72002a7
SHA256

80ccb4a6fd001b72e733901b689b341c011780b130a1c3589f3fce63cf06c5b4
SHA512

aa5534db77c14bc02e773b9574a89584afbc6b1c25d3692b1f773962fb768722b99545a7b4a521763362e762e352c9a604fca87505e796dbdeee70a33530cef2
SSDEEP

384:wftchk9aYNNcw4ZKRiElCNpayS019l3DK0ce8cfHqxfu:wlcW9a8NcrZKRK9l3HcEgG

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2028-0-0x0000000010000000-0x0000000010014000-memory.dmp	upx
behavioral1/memory/2028-1-0x0000000010000000-0x0000000010014000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1952	2028	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2028	2160	rundll32.exe	30
PID 2160 wrote to memory of 2028	2160	rundll32.exe	30
PID 2160 wrote to memory of 2028	2160	rundll32.exe	30
PID 2160 wrote to memory of 2028	2160	rundll32.exe	30
PID 2160 wrote to memory of 2028	2160	rundll32.exe	30
PID 2160 wrote to memory of 2028	2160	rundll32.exe	30
PID 2160 wrote to memory of 2028	2160	rundll32.exe	30
PID 2028 wrote to memory of 1952	2028	rundll32.exe	31
PID 2028 wrote to memory of 1952	2028	rundll32.exe	31
PID 2028 wrote to memory of 1952	2028	rundll32.exe	31
PID 2028 wrote to memory of 1952	2028	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35809d5f8d1ea9c7ea598bf50499881b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\35809d5f8d1ea9c7ea598bf50499881b_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 240
    3⤵
    - Program crash
    PID:1952

memory/2028-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/2028-1-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download