e20966be1892d8e0861d18c271dacd601a589d3bc0ddce31d49d6653da2fa61d

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 17:05

Target

a16f78a505b3f4afe0ca2809b2d94cfe_JaffaCakes118.dll
Size

369KB
MD5

a16f78a505b3f4afe0ca2809b2d94cfe
SHA1

172ff5849c31361f10187114a82c5c95000e8bf1
SHA256

e20966be1892d8e0861d18c271dacd601a589d3bc0ddce31d49d6653da2fa61d
SHA512

5d05cf5050ab193bc87a09749d5bba935662ddae4736cdd3ec30a2b56f5754b91f7f0986c90d421a1620ead0fea9104972389d71642a56b034fe57297a2d5bb8
SSDEEP

6144:7x0RuhQV/yICtRo/dg+Q7navqN+ZHO8dmDLHFh13n/t+lXEbGtl:KRMO/yIC4WnnavOMO8ghNV+ubs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1836	2224	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2224	3056	rundll32.exe	28
PID 3056 wrote to memory of 2224	3056	rundll32.exe	28
PID 3056 wrote to memory of 2224	3056	rundll32.exe	28
PID 3056 wrote to memory of 2224	3056	rundll32.exe	28
PID 3056 wrote to memory of 2224	3056	rundll32.exe	28
PID 3056 wrote to memory of 2224	3056	rundll32.exe	28
PID 3056 wrote to memory of 2224	3056	rundll32.exe	28
PID 2224 wrote to memory of 1836	2224	rundll32.exe	29
PID 2224 wrote to memory of 1836	2224	rundll32.exe	29
PID 2224 wrote to memory of 1836	2224	rundll32.exe	29
PID 2224 wrote to memory of 1836	2224	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a16f78a505b3f4afe0ca2809b2d94cfe_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a16f78a505b3f4afe0ca2809b2d94cfe_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 244
    3⤵
    - Program crash
    PID:1836

memory/2224-0-0x0000000000740000-0x00000000007A1000-memory.dmp

Filesize
388KB

Download
memory/2224-1-0x0000000000740000-0x00000000007A1000-memory.dmp

Filesize
388KB

Download