0a5002a1f13877cec8c169bedbbf4a1d255de6df8b32de2199bf08bf423095d8

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 12:00

Target

678319431a1fb2474d43bfe2d563e194_JaffaCakes118.dll
Size

70KB
MD5

678319431a1fb2474d43bfe2d563e194
SHA1

a7e63d1847b8595126aa5278c27b3a29869d8cfd
SHA256

0a5002a1f13877cec8c169bedbbf4a1d255de6df8b32de2199bf08bf423095d8
SHA512

b93747b4bab11c4031e5c0210973a84567798976b7f2fceee862d12ccefd2be3b7ba6bb524ab1bfdf7f123b0edc3865236ced13df9b4cd2b5234e251eb9812db
SSDEEP

1536:hXLwtq0c49MKioFjSz1UFLE/dW5MMbKl89h9LMTlp/8zWqlLqw7t1FVSr77Gnous:hXLwt/FiaU1Uq/dWFbNr8azD7VS372oj

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2692-0-0x0000000000110000-0x0000000000146000-memory.dmp	upx
behavioral1/memory/2692-1-0x0000000000220000-0x0000000000256000-memory.dmp	upx
behavioral1/memory/2692-3-0x0000000000110000-0x0000000000146000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	2692	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 2692	1188	regsvr32.exe	30
PID 1188 wrote to memory of 2692	1188	regsvr32.exe	30
PID 1188 wrote to memory of 2692	1188	regsvr32.exe	30
PID 1188 wrote to memory of 2692	1188	regsvr32.exe	30
PID 1188 wrote to memory of 2692	1188	regsvr32.exe	30
PID 1188 wrote to memory of 2692	1188	regsvr32.exe	30
PID 1188 wrote to memory of 2692	1188	regsvr32.exe	30
PID 2692 wrote to memory of 2756	2692	regsvr32.exe	31
PID 2692 wrote to memory of 2756	2692	regsvr32.exe	31
PID 2692 wrote to memory of 2756	2692	regsvr32.exe	31
PID 2692 wrote to memory of 2756	2692	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\678319431a1fb2474d43bfe2d563e194_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\678319431a1fb2474d43bfe2d563e194_JaffaCakes118.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 324
    3⤵
    - Program crash
    PID:2756

memory/2692-0-0x0000000000110000-0x0000000000146000-memory.dmp

Filesize
216KB

Download
memory/2692-1-0x0000000000220000-0x0000000000256000-memory.dmp

Filesize
216KB

Download
memory/2692-3-0x0000000000110000-0x0000000000146000-memory.dmp

Filesize
216KB

Download
memory/2692-4-0x00000000020C0000-0x00000000021D0000-memory.dmp

Filesize
1.1MB

Download