671ae1408fd9572e79df2cc5ecfba052ca247b28ee4d7bf88a099a535ed638c8

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 19:03

Target

fd6d288db9c1472c54f96c17fef315b2_JaffaCakes118.dll
Size

64KB
MD5

fd6d288db9c1472c54f96c17fef315b2
SHA1

01b17880b6cdacd829bf2b21ebc2d14dcce9273e
SHA256

671ae1408fd9572e79df2cc5ecfba052ca247b28ee4d7bf88a099a535ed638c8
SHA512

bd4fc00f6564d0aa43aae49a0069bed1077cfced734849abdc765d5b64222e835b8364b8021ea0bb9b6dcc82b034baca1a2445021f2baa986f6c794fc0f4a496
SSDEEP

1536:/RvcsiaubJo03Aw1lJEfgqRLXoY2yEWU9yKlp:/RvcsiXDwgmIq9XoRyEf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	2704	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2704	2924	rundll32.exe	28
PID 2924 wrote to memory of 2704	2924	rundll32.exe	28
PID 2924 wrote to memory of 2704	2924	rundll32.exe	28
PID 2924 wrote to memory of 2704	2924	rundll32.exe	28
PID 2924 wrote to memory of 2704	2924	rundll32.exe	28
PID 2924 wrote to memory of 2704	2924	rundll32.exe	28
PID 2924 wrote to memory of 2704	2924	rundll32.exe	28
PID 2704 wrote to memory of 2668	2704	rundll32.exe	29
PID 2704 wrote to memory of 2668	2704	rundll32.exe	29
PID 2704 wrote to memory of 2668	2704	rundll32.exe	29
PID 2704 wrote to memory of 2668	2704	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd6d288db9c1472c54f96c17fef315b2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd6d288db9c1472c54f96c17fef315b2_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 268
    3⤵
    - Program crash
    PID:2668

memory/2704-0-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/2704-1-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/2704-2-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2704-3-0x0000000000190000-0x000000000019C000-memory.dmp

Filesize
48KB

Download
memory/2704-4-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download