304f2c5c7c816082924dc480fd469dfcfad8204a469f4d44484ec812fcb4ec2e

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 02:20

Target

65c4a2439293ad1a5f1d4071a25bb750_JaffaCakes118.dll
Size

15KB
MD5

65c4a2439293ad1a5f1d4071a25bb750
SHA1

4936ade99adf6c7985fdc2aef6c454084c6b0795
SHA256

304f2c5c7c816082924dc480fd469dfcfad8204a469f4d44484ec812fcb4ec2e
SHA512

6100209ae04af2bb139d7ea780946bfd972add59245f6b1c97fd0fbe812d4c28857ef3b009d8eadfb87287f977e20832e4cd76a8653773ab8982f269a6e469fe
SSDEEP

384:kjOm6QRh9ShNAcNRkxCJL7wc2cVowOOQ5UPGjJ0cDjfmy1E:8F6u9aNFNR7SedOLUDcvmy1E

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4328-1-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/4328-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/4328-2-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4548	4328	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4328	rundll32.exe
4328	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 4328	3872	rundll32.exe	84
PID 3872 wrote to memory of 4328	3872	rundll32.exe	84
PID 3872 wrote to memory of 4328	3872	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65c4a2439293ad1a5f1d4071a25bb750_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\65c4a2439293ad1a5f1d4071a25bb750_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 568
    3⤵
    - Program crash
    PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4328 -ip 4328
1⤵
PID:1900

memory/4328-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4328-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4328-2-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4328-3-0x0000000010001000-0x000000001000A000-memory.dmp

Filesize
36KB

Download