Analysis
-
max time kernel
138s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 10:12
Static task
static1
Behavioral task
behavioral1
Sample
6727b4fbe1f02de04136b3bde2f2beac_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6727b4fbe1f02de04136b3bde2f2beac_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsisProcMgr_U.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsisProcMgr_U.dll
Resource
win10v2004-20240709-en
General
-
Target
$PLUGINSDIR/System.dll
-
Size
9KB
-
MD5
9c32a7501c959b4aed7fd64313137ecc
-
SHA1
f59b561fe96bcc3ce3967ebb8811d8a98a34f134
-
SHA256
fd58286ab8abf3400912809a78d679f75b8054878e804a8e9767b2379f184f71
-
SHA512
2db04fdb6c77cfe09db8a4d4b33ab20561544eb8344e15bec521e62a49225389ae612feef127a8b1af2858d2e0517d0bbb71510482a19466be309f7bffe3bc28
-
SSDEEP
96:rDhuJxuSaQJOhgO0nOQ3MnU+RyWg1sMI45CS5bGCs5/LxLo5R4uaGZef4cX1l8Sy:rVS+6dMU+wWg1sMI4/5aCs51gHDFaeN
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4124 2228 WerFault.exe 84 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2976 wrote to memory of 2228 2976 rundll32.exe 84 PID 2976 wrote to memory of 2228 2976 rundll32.exe 84 PID 2976 wrote to memory of 2228 2976 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#12⤵PID:2228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 6203⤵
- Program crash
PID:4124
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2228 -ip 22281⤵PID:3324