buer | bf18fdac218b1c74d291145834f7060a96ac8af15f5c693d80aa04c2824193c9

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 02:26

Target

4c6d461e3d54cb8c31a7583ff4d891ea_JaffaCakes118.dll
Size

789KB
MD5

4c6d461e3d54cb8c31a7583ff4d891ea
SHA1

febafa00a2ca1cfd96705c3341dc10dde880dee9
SHA256

bf18fdac218b1c74d291145834f7060a96ac8af15f5c693d80aa04c2824193c9
SHA512

506363f19e380db162fcd7e68c267b7606b474e3c4407dc10ceff26295f022813cd080413bc6a7ec47f957e70134156a453ab6b69696ef3c80155f11ff5fb841
SSDEEP

12288:Gl5wn1tqJdEJcFxTzmevkYKViWQRoITdOCsljq:GTwn1tbGFxTzmevkYK5QG

Score

10^/10

buer loader

Family

buer

mirrorsoffecalbank.com

Buer Loader 1 IoCs

Detects Buer loader in memory or disk.

resource	yara_rule
behavioral2/memory/740-1-0x0000000000400000-0x00000000006CA000-memory.dmp	buer

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 740	2860	regsvr32.exe	83
PID 2860 wrote to memory of 740	2860	regsvr32.exe	83
PID 2860 wrote to memory of 740	2860	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4c6d461e3d54cb8c31a7583ff4d891ea_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4c6d461e3d54cb8c31a7583ff4d891ea_JaffaCakes118.dll
  2⤵
  PID:740

memory/740-0-0x0000000000405000-0x0000000000407000-memory.dmp

Filesize
8KB

Download
memory/740-1-0x0000000000400000-0x00000000006CA000-memory.dmp

Filesize
2.8MB

Download
memory/740-4-0x0000000000405000-0x0000000000407000-memory.dmp

Filesize
8KB

Download