Analysis
-
max time kernel
138s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
16-07-2024 20:11
Static task
static1
Behavioral task
behavioral1
Sample
4fdee5a59295dca9f41205a51b593c35_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4fdee5a59295dca9f41205a51b593c35_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
yrcvb.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
yrcvb.dll
Resource
win10v2004-20240709-en
General
-
Target
yrcvb.dll
-
Size
11KB
-
MD5
2072ef8fa8d7b21c6710dd45329ed960
-
SHA1
c37e442611dca9cba6af656c1f570432eb1f8d34
-
SHA256
74c0cbf5666dfdd57165bf6ec429d69b1b471ee10d9451d059099c9a4af0453a
-
SHA512
198aacdc2178a5ce7cbf834346f7c97b9c95f19796879281472c9c582bae2a7cb850e37d76b553f84601563ff2d225b10db26213c4f12eb5f0b3392d93585b61
-
SSDEEP
192:fxS0MwFVGomA2mBilFlfFHavKRB5N83c35cIbaJxJFCGHJP:wwjj4oilFHavKRh865cIb6H
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4580 4464 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
rundll32.exepid process 4464 rundll32.exe 4464 rundll32.exe 4464 rundll32.exe 4464 rundll32.exe 4464 rundll32.exe 4464 rundll32.exe 4464 rundll32.exe 4464 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1976 wrote to memory of 4464 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 4464 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 4464 1976 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\yrcvb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\yrcvb.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:4464 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 6963⤵
- Program crash
PID:4580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4464 -ip 44641⤵PID:2520