ce7bc210779989a9b5fad9d1b7b8c53d6fba37614b8387d1327958f14a311c15

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 17:04

Target

3e2aab25fff0529721eb8a12b341b5af_JaffaCakes118.dll
Size

278KB
MD5

3e2aab25fff0529721eb8a12b341b5af
SHA1

16bc9431575411fd35ff25c5024fca4873d26dcb
SHA256

ce7bc210779989a9b5fad9d1b7b8c53d6fba37614b8387d1327958f14a311c15
SHA512

debc46701653d0a6eb357d6e7572cb898a06eff16730fff3e913923e263848be1b45c04a727450816b92e2e7a751d216ae86e308ae280b81ebbf42244a8487f2
SSDEEP

6144:1ZFh/0bKu7ZcD0wEaoX/OPthW+fmAWgWVKFl0xsDNmtZ0Kaw7t83/MqLscoS+:DEZcDP2UH3ZRl7sqwR05LscoS+

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3440-0-0x0000000010000000-0x00000000100A2000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5112	3440	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 3440	1748	rundll32.exe	83
PID 1748 wrote to memory of 3440	1748	rundll32.exe	83
PID 1748 wrote to memory of 3440	1748	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e2aab25fff0529721eb8a12b341b5af_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e2aab25fff0529721eb8a12b341b5af_JaffaCakes118.dll,#1
  2⤵
  PID:3440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 568
    3⤵
    - Program crash
    PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3440 -ip 3440
1⤵
PID:2192

memory/3440-0-0x0000000010000000-0x00000000100A2000-memory.dmp

Filesize
648KB

Download