fa67d7e9e9ea30ea9b4aa885a005ef9bb192589b4e662782fca2eaf4df2e4a51

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 00:09

Target

5e44eb7902b1d20f981f1866a0aeeb1c_JaffaCakes118.dll
Size

10KB
MD5

5e44eb7902b1d20f981f1866a0aeeb1c
SHA1

dcdb431c479e8695c5030c6dd69e349590e2eee2
SHA256

fa67d7e9e9ea30ea9b4aa885a005ef9bb192589b4e662782fca2eaf4df2e4a51
SHA512

31666055834ca2d393871090c2cf3ba6b513c1c872ce0af9c8986304690ff87afbf8c03055110f33c330a715407151b961417f921ad5a5a2a3f9d12af7c82038
SSDEEP

192:wxs43+cnFqVEXvWcT5r3rAUI9++pqTt5oZVEywGMzL99YA5/T+GMr9dN9e1:csgPnFqOOaIZxpqTIZWywJPH7+GGc

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2420-3-0x0000000010000000-0x000000001000A000-memory.dmp	upx
behavioral1/memory/2420-4-0x0000000010000000-0x000000001000A000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1512	2420	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2420	2192	rundll32.exe	30
PID 2192 wrote to memory of 2420	2192	rundll32.exe	30
PID 2192 wrote to memory of 2420	2192	rundll32.exe	30
PID 2192 wrote to memory of 2420	2192	rundll32.exe	30
PID 2192 wrote to memory of 2420	2192	rundll32.exe	30
PID 2192 wrote to memory of 2420	2192	rundll32.exe	30
PID 2192 wrote to memory of 2420	2192	rundll32.exe	30
PID 2420 wrote to memory of 1512	2420	rundll32.exe	31
PID 2420 wrote to memory of 1512	2420	rundll32.exe	31
PID 2420 wrote to memory of 1512	2420	rundll32.exe	31
PID 2420 wrote to memory of 1512	2420	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e44eb7902b1d20f981f1866a0aeeb1c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e44eb7902b1d20f981f1866a0aeeb1c_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 248
    3⤵
    - Program crash
    PID:1512

memory/2420-3-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/2420-2-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/2420-1-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/2420-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/2420-4-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download