ca6ce610a08ac84fd0a7d32b8876226b5e0533f46fb132dd83d0c831a83e4f15

Analysis

max time kernel
95s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 13:38

Target

3d98a6743e5aae9c304117d02d3b804e_JaffaCakes118.dll
Size

66KB
MD5

3d98a6743e5aae9c304117d02d3b804e
SHA1

78c7b6f8694292b1a718c29a987b6e5bf7c30ebd
SHA256

ca6ce610a08ac84fd0a7d32b8876226b5e0533f46fb132dd83d0c831a83e4f15
SHA512

231ed1031e6b2c660646334c8dabf55294eb2ada9163a61055b53ea4046e6a0c0e6000097d54be5a8388a154e8c7e197b146e3c9978f6770e34a3e57168a09ba
SSDEEP

1536:5K5xXZQgIfVDF2T2b+a727nNeYS5LkN/rN+pW:5Knagp0XqZeYSRkNRUW

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2376-0-0x0000000010000000-0x0000000010042000-memory.dmp	upx
behavioral2/memory/2376-1-0x0000000010000000-0x0000000010042000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4232	2376	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 2376	4856	rundll32.exe	85
PID 4856 wrote to memory of 2376	4856	rundll32.exe	85
PID 4856 wrote to memory of 2376	4856	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d98a6743e5aae9c304117d02d3b804e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d98a6743e5aae9c304117d02d3b804e_JaffaCakes118.dll,#1
  2⤵
  PID:2376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 692
    3⤵
    - Program crash
    PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2376 -ip 2376
1⤵
PID:1300

memory/2376-0-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download
memory/2376-1-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download