db0d0c3dc48d3d619b4ee7cdc63ef2726c7781c8d9981e836cfbac45b3d27bb7

Analysis

max time kernel
96s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 07:21

Target

48c8d3cf51777df66b48b5daf42896e7_JaffaCakes118.dll
Size

202KB
MD5

48c8d3cf51777df66b48b5daf42896e7
SHA1

4bb1be0a60e738225bb9f024ca01bb51031b0ed1
SHA256

db0d0c3dc48d3d619b4ee7cdc63ef2726c7781c8d9981e836cfbac45b3d27bb7
SHA512

a82cbd148d94f14420bcefe8744b86b8fe8b3081e5133bd272f17aa9e914f74423e7fcb060470c183ecefa835427061d62c096b56243a487a7593dec459738d4
SSDEEP

6144:vE/tmQKul1p9sjeRcsBPcu5y9xaJr3tnmdZy4Z:vE/tmtuZLpJcusxKwdfZ

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3056-0-0x0000000000400000-0x000000000044D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3736	3056	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 3056	5108	rundll32.exe	83
PID 5108 wrote to memory of 3056	5108	rundll32.exe	83
PID 5108 wrote to memory of 3056	5108	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48c8d3cf51777df66b48b5daf42896e7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\48c8d3cf51777df66b48b5daf42896e7_JaffaCakes118.dll,#1
  2⤵
  PID:3056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 568
    3⤵
    - Program crash
    PID:3736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3056 -ip 3056
1⤵
PID:2952

memory/3056-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3056-1-0x0000000000DE0000-0x0000000000DF5000-memory.dmp

Filesize
84KB

Download