fa67d7e9e9ea30ea9b4aa885a005ef9bb192589b4e662782fca2eaf4df2e4a51

Analysis

max time kernel
139s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 00:09

Target

5e44eb7902b1d20f981f1866a0aeeb1c_JaffaCakes118.dll
Size

10KB
MD5

5e44eb7902b1d20f981f1866a0aeeb1c
SHA1

dcdb431c479e8695c5030c6dd69e349590e2eee2
SHA256

fa67d7e9e9ea30ea9b4aa885a005ef9bb192589b4e662782fca2eaf4df2e4a51
SHA512

31666055834ca2d393871090c2cf3ba6b513c1c872ce0af9c8986304690ff87afbf8c03055110f33c330a715407151b961417f921ad5a5a2a3f9d12af7c82038
SSDEEP

192:wxs43+cnFqVEXvWcT5r3rAUI9++pqTt5oZVEywGMzL99YA5/T+GMr9dN9e1:csgPnFqOOaIZxpqTIZWywJPH7+GGc

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4480-0-0x0000000010000000-0x000000001000A000-memory.dmp	upx
behavioral2/memory/4480-2-0x0000000010000000-0x000000001000A000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2836	4480	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 4480	2528	rundll32.exe	84
PID 2528 wrote to memory of 4480	2528	rundll32.exe	84
PID 2528 wrote to memory of 4480	2528	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e44eb7902b1d20f981f1866a0aeeb1c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e44eb7902b1d20f981f1866a0aeeb1c_JaffaCakes118.dll,#1
  2⤵
  PID:4480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 632
    3⤵
    - Program crash
    PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4480 -ip 4480
1⤵
PID:3000

memory/4480-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/4480-2-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download