3cc84f0064458ce6aa5fc0baf5fd3fd3c42aed7895b332dd34feed72cf3f75f7

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 19:13

Target

6852280400ef005033fbe0fc03dfa3be_JaffaCakes118.dll
Size

153KB
MD5

6852280400ef005033fbe0fc03dfa3be
SHA1

86827bb97e622fdc84df04678f5be2dc9cc9ee2d
SHA256

3cc84f0064458ce6aa5fc0baf5fd3fd3c42aed7895b332dd34feed72cf3f75f7
SHA512

8c808eae5af37d2c307d7958236a6e07738bad2a9a53928f4e59035bfc81f980e40bbfd07ffed8386450386738eb97f710404b59c9cf78f9883d002fddab5f45
SSDEEP

3072:TiE1U5jmVJ6Cxv2MOX3pwi4ThazNEjLdur561d:CjAfxv2bXe6EVq52

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1780	1912	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 1912	1920	rundll32.exe	28
PID 1920 wrote to memory of 1912	1920	rundll32.exe	28
PID 1920 wrote to memory of 1912	1920	rundll32.exe	28
PID 1920 wrote to memory of 1912	1920	rundll32.exe	28
PID 1920 wrote to memory of 1912	1920	rundll32.exe	28
PID 1920 wrote to memory of 1912	1920	rundll32.exe	28
PID 1920 wrote to memory of 1912	1920	rundll32.exe	28
PID 1912 wrote to memory of 1780	1912	rundll32.exe	29
PID 1912 wrote to memory of 1780	1912	rundll32.exe	29
PID 1912 wrote to memory of 1780	1912	rundll32.exe	29
PID 1912 wrote to memory of 1780	1912	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6852280400ef005033fbe0fc03dfa3be_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6852280400ef005033fbe0fc03dfa3be_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 288
    3⤵
    - Program crash
    PID:1780

memory/1912-1-0x0000000010000000-0x000000001006F000-memory.dmp

Filesize
444KB

Download
memory/1912-0-0x0000000010000000-0x000000001006F000-memory.dmp

Filesize
444KB

Download
memory/1912-2-0x000000001006D000-0x000000001006E000-memory.dmp

Filesize
4KB

Download