3f2d10f9931902e3867cbaf0819f8d40eaacede924495488836092f46c9a7dab

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 13:57

Target

f82497578efe0170c08b4f4422a38a08_JaffaCakes118.dll
Size

434KB
MD5

f82497578efe0170c08b4f4422a38a08
SHA1

c404e535126cfd69fb022b8d6d77dc8ce40d37eb
SHA256

3f2d10f9931902e3867cbaf0819f8d40eaacede924495488836092f46c9a7dab
SHA512

362fb27fefc68029d545082410da5263da13dde936c84b7cdc31b9cdce3138534dd2a9a30d3775f04b8fe0c6b42e5696bf32f4bc87b6a29ec271a7c406fe7b7c
SSDEEP

12288:H0i7OPD6DBMMWNCEd3Y/B5/LFiupJ7EEQ:EPDAqB36FBJ7ET

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2296	2252	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2252	2292	rundll32.exe	28
PID 2292 wrote to memory of 2252	2292	rundll32.exe	28
PID 2292 wrote to memory of 2252	2292	rundll32.exe	28
PID 2292 wrote to memory of 2252	2292	rundll32.exe	28
PID 2292 wrote to memory of 2252	2292	rundll32.exe	28
PID 2292 wrote to memory of 2252	2292	rundll32.exe	28
PID 2292 wrote to memory of 2252	2292	rundll32.exe	28
PID 2252 wrote to memory of 2296	2252	rundll32.exe	29
PID 2252 wrote to memory of 2296	2252	rundll32.exe	29
PID 2252 wrote to memory of 2296	2252	rundll32.exe	29
PID 2252 wrote to memory of 2296	2252	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f82497578efe0170c08b4f4422a38a08_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f82497578efe0170c08b4f4422a38a08_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 248
    3⤵
    - Program crash
    PID:2296

memory/2252-0-0x00000000002B0000-0x0000000000310000-memory.dmp

Filesize
384KB

Download
memory/2252-1-0x00000000009A0000-0x0000000000A0F000-memory.dmp

Filesize
444KB

Download
memory/2252-5-0x00000000002B0000-0x0000000000310000-memory.dmp

Filesize
384KB

Download