ace4df46abaf2d9d36b74a72748a2110049fcdb4f4d985b95259a70f05f37626

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 02:11

Target

01f3e34234dd38b9f92210193ceae51e_JaffaCakes118.dll
Size

239KB
MD5

01f3e34234dd38b9f92210193ceae51e
SHA1

640676a05e7b84ff95930a9606ba07a4fad06f1f
SHA256

ace4df46abaf2d9d36b74a72748a2110049fcdb4f4d985b95259a70f05f37626
SHA512

1655a5dffc6eb26d50fbcdb286d7d1d8cf536988f3d8732fbc18cd44f5d7c43fc12d68a1aab29a8cf054f2231a91edaecec3903792f01ad1b3f5a6a77aae4108
SSDEEP

6144:lKfMqS07Lo4usgJUmrtIzaI7Jxt9BmRy4px5z:nS/usgJU1R7lW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1820	1968	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1968	2072	rundll32.exe	28
PID 2072 wrote to memory of 1968	2072	rundll32.exe	28
PID 2072 wrote to memory of 1968	2072	rundll32.exe	28
PID 2072 wrote to memory of 1968	2072	rundll32.exe	28
PID 2072 wrote to memory of 1968	2072	rundll32.exe	28
PID 2072 wrote to memory of 1968	2072	rundll32.exe	28
PID 2072 wrote to memory of 1968	2072	rundll32.exe	28
PID 1968 wrote to memory of 1820	1968	rundll32.exe	29
PID 1968 wrote to memory of 1820	1968	rundll32.exe	29
PID 1968 wrote to memory of 1820	1968	rundll32.exe	29
PID 1968 wrote to memory of 1820	1968	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01f3e34234dd38b9f92210193ceae51e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01f3e34234dd38b9f92210193ceae51e_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 224
    3⤵
    - Program crash
    PID:1820

memory/1968-1-0x0000000000230000-0x00000000002A8000-memory.dmp

Filesize
480KB

Download
memory/1968-4-0x0000000000180000-0x00000000001B8000-memory.dmp

Filesize
224KB

Download
memory/1968-5-0x0000000000180000-0x00000000001B8000-memory.dmp

Filesize
224KB

Download