7ed55791e7dcade3477e3561d411dc500835ec6cbd390a8f04357931185aea1b

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 03:16

Target

44116f956c57af7b4bedf2492bb8af9b_JaffaCakes118.dll
Size

11KB
MD5

44116f956c57af7b4bedf2492bb8af9b
SHA1

578187d49b5433ef7f72021e3330c41e5e64a965
SHA256

7ed55791e7dcade3477e3561d411dc500835ec6cbd390a8f04357931185aea1b
SHA512

1c490d1a91871dcf4fa3e57b7106af72f5d17f5d3042cf8fa01e18117f784a53dbe89fd6b85532d2df44cbad5ac472004853fcdd3d644f85171a9fb8b1814902
SSDEEP

192:fqn51yDvVmBbxdVSr2beTn6qTojg5I8UHI7C0mbeKGBQeMgULUdMUYBc:2vyDgBFd6t3SyKreMgqB

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1416-0-0x0000000010000000-0x00000000100FF000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4020	1416	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 1416	3844	rundll32.exe	83
PID 3844 wrote to memory of 1416	3844	rundll32.exe	83
PID 3844 wrote to memory of 1416	3844	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44116f956c57af7b4bedf2492bb8af9b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44116f956c57af7b4bedf2492bb8af9b_JaffaCakes118.dll,#1
  2⤵
  PID:1416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 596
    3⤵
    - Program crash
    PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1416 -ip 1416
1⤵
PID:4344

memory/1416-0-0x0000000010000000-0x00000000100FF000-memory.dmp

Filesize
1020KB

Download