ebc2a69929e84bdfaca4fb3804240ab1ceaea69c6664cfa29442f6b52b31cef6

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 18:52

Target

610613fa7732bf81c2a98e5479a0b180_JaffaCakes118.dll
Size

181KB
MD5

610613fa7732bf81c2a98e5479a0b180
SHA1

8e9aca851098cccfe4b701466ae170214e0d25fe
SHA256

ebc2a69929e84bdfaca4fb3804240ab1ceaea69c6664cfa29442f6b52b31cef6
SHA512

094a9a512d7d7459f1c41479f5943f3f29df4a279b179a62edf8d473db6aa17d3fb173c5f43575bdc2d4800df64e4bc6560047ee423aca8c0892484656285a08
SSDEEP

3072:tBrNNeA7Flky1ZRWIhh+DNdoepSEvAMyzkmWK4Z2O+Q+1Iic6pcmdy0ZyPIouty:tpb7FlkevWFJdo2dyzkmWK4Z2OsWibpV

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4660-0-0x0000000000400000-0x000000000044C000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4936	4660	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 4660	5116	rundll32.exe	85
PID 5116 wrote to memory of 4660	5116	rundll32.exe	85
PID 5116 wrote to memory of 4660	5116	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\610613fa7732bf81c2a98e5479a0b180_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\610613fa7732bf81c2a98e5479a0b180_JaffaCakes118.dll,#1
  2⤵
  PID:4660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 544
    3⤵
    - Program crash
    PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4660 -ip 4660
1⤵
PID:3680

memory/4660-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4660-1-0x00000000012D0000-0x00000000012E5000-memory.dmp

Filesize
84KB

Download