b0de897f2dce5ba699b5ee67fc22204b485aedd97db3f90df2a45b0c392d3e02

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 00:19

Target

f913c3a15a1301296d12c7f2066fc5a9_JaffaCakes118.dll
Size

52KB
MD5

f913c3a15a1301296d12c7f2066fc5a9
SHA1

e5cfedcc45656a5b5827d747c40cb040c4bb751e
SHA256

b0de897f2dce5ba699b5ee67fc22204b485aedd97db3f90df2a45b0c392d3e02
SHA512

96a60d610c7340e78af490c5d3af4850761778fb927a39ddd1d254a3660e98bcb9b6dcc542b85dad43b35c2ca3bc6a3c84f36ba0f14be7573354f612e0c128c7
SSDEEP

1536:9tJMFP4iGROKOgnKpHDJv3tDDZTgocj3:nWuiGMnCqJvtGoe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3004	1592	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1592	1640	rundll32.exe	28
PID 1640 wrote to memory of 1592	1640	rundll32.exe	28
PID 1640 wrote to memory of 1592	1640	rundll32.exe	28
PID 1640 wrote to memory of 1592	1640	rundll32.exe	28
PID 1640 wrote to memory of 1592	1640	rundll32.exe	28
PID 1640 wrote to memory of 1592	1640	rundll32.exe	28
PID 1640 wrote to memory of 1592	1640	rundll32.exe	28
PID 1592 wrote to memory of 3004	1592	rundll32.exe	29
PID 1592 wrote to memory of 3004	1592	rundll32.exe	29
PID 1592 wrote to memory of 3004	1592	rundll32.exe	29
PID 1592 wrote to memory of 3004	1592	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f913c3a15a1301296d12c7f2066fc5a9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f913c3a15a1301296d12c7f2066fc5a9_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 232
    3⤵
    - Program crash
    PID:3004

memory/1592-2-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1592-3-0x0000000000BD0000-0x0000000000CA6000-memory.dmp

Filesize
856KB

Download
memory/1592-4-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download