f12505e44022518e6da9db41f1f20b96ab6059284f5a7f79eb3358f40b896249

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 18:35

Target

08b25dc9863532ce2cba51831117018a_JaffaCakes118.dll
Size

357KB
MD5

08b25dc9863532ce2cba51831117018a
SHA1

b5ba45744dd9737df7ab08183f0751cb5ac9409a
SHA256

f12505e44022518e6da9db41f1f20b96ab6059284f5a7f79eb3358f40b896249
SHA512

6813fc294114bc7a395e7df623a370c9e397ec4e4113ca48be774c11245fe9d1a81219df175c132af8d5d4c8611b9e26b25d4f3ccdbd76e897a527137fbd45bb
SSDEEP

6144:kJ9Mnxck/ipE3za46Q+Gjw/f6mpTaoFoa+SRWT35i3JyMiUoljTBd8A:vnykwE3WZbGjyloT3gEMiUoljTA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2968	2308	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2308	2204	rundll32.exe	28
PID 2204 wrote to memory of 2308	2204	rundll32.exe	28
PID 2204 wrote to memory of 2308	2204	rundll32.exe	28
PID 2204 wrote to memory of 2308	2204	rundll32.exe	28
PID 2204 wrote to memory of 2308	2204	rundll32.exe	28
PID 2204 wrote to memory of 2308	2204	rundll32.exe	28
PID 2204 wrote to memory of 2308	2204	rundll32.exe	28
PID 2308 wrote to memory of 2968	2308	rundll32.exe	29
PID 2308 wrote to memory of 2968	2308	rundll32.exe	29
PID 2308 wrote to memory of 2968	2308	rundll32.exe	29
PID 2308 wrote to memory of 2968	2308	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\08b25dc9863532ce2cba51831117018a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\08b25dc9863532ce2cba51831117018a_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 264
    3⤵
    - Program crash
    PID:2968

memory/2308-0-0x0000000001D50000-0x0000000001DAF000-memory.dmp

Filesize
380KB

Download
memory/2308-1-0x0000000001D50000-0x0000000001DAF000-memory.dmp

Filesize
380KB

Download