e8e6e66dfaec2d1bb7222144d85de1e9fdcd9b122b3684b70b27f101b3fde6b5

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 08:55

Target

83a413f7f11dc9b34e0aed9e84230928_JaffaCakes118.dll
Size

9.2MB
MD5

83a413f7f11dc9b34e0aed9e84230928
SHA1

782e16e22940358029950bf149fc8c1eff62fd59
SHA256

e8e6e66dfaec2d1bb7222144d85de1e9fdcd9b122b3684b70b27f101b3fde6b5
SHA512

3310ec41fc0f28148ea3c0cb446f5d46dc0ce3b7779c7c445ec1bde27147e928a4038b20f42b801bf7d48c7ed2edab5655677f3daff9c5e8e2c1244dff1616ba
SSDEEP

196608:5XvrFfmeZxlJftcOSMF7meqhbgFchbKRzHxL:5XFZpFchmT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	2052	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2052	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2052	2952	rundll32.exe	28
PID 2952 wrote to memory of 2052	2952	rundll32.exe	28
PID 2952 wrote to memory of 2052	2952	rundll32.exe	28
PID 2952 wrote to memory of 2052	2952	rundll32.exe	28
PID 2952 wrote to memory of 2052	2952	rundll32.exe	28
PID 2952 wrote to memory of 2052	2952	rundll32.exe	28
PID 2952 wrote to memory of 2052	2952	rundll32.exe	28
PID 2052 wrote to memory of 2756	2052	rundll32.exe	29
PID 2052 wrote to memory of 2756	2052	rundll32.exe	29
PID 2052 wrote to memory of 2756	2052	rundll32.exe	29
PID 2052 wrote to memory of 2756	2052	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83a413f7f11dc9b34e0aed9e84230928_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\83a413f7f11dc9b34e0aed9e84230928_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 280
    3⤵
    - Program crash
    PID:2756

memory/2052-0-0x0000000002000000-0x000000000294A000-memory.dmp

Filesize
9.3MB

Download
memory/2052-2-0x0000000002000000-0x000000000294A000-memory.dmp

Filesize
9.3MB

Download