9421773b1b03c96e98c73ef830701e1c84a8976f02f0539840aafa14c8778d1c

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 00:54

Target

0ba3a0d43a2afb3d4b9e24426123f5f5_JaffaCakes118.dll
Size

878KB
MD5

0ba3a0d43a2afb3d4b9e24426123f5f5
SHA1

632d138514ba058e4e0e0adedda082427127adc3
SHA256

9421773b1b03c96e98c73ef830701e1c84a8976f02f0539840aafa14c8778d1c
SHA512

b57ce838fd7084f286a4beb99fa3b5df7bac1d56967622ece104c2599318908683dc5dfba8984a2bb94a18212cf9f3adf5ad97cc81b2187213e2e2eea834fbe0
SSDEEP

24576:5SRk+Rmj6+0V0Yq2keV5WmQh7pEuMOeH4/Gt:4hpapEuE5t

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1812	1984	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 1984	2576	rundll32.exe	28
PID 2576 wrote to memory of 1984	2576	rundll32.exe	28
PID 2576 wrote to memory of 1984	2576	rundll32.exe	28
PID 2576 wrote to memory of 1984	2576	rundll32.exe	28
PID 2576 wrote to memory of 1984	2576	rundll32.exe	28
PID 2576 wrote to memory of 1984	2576	rundll32.exe	28
PID 2576 wrote to memory of 1984	2576	rundll32.exe	28
PID 1984 wrote to memory of 1812	1984	rundll32.exe	29
PID 1984 wrote to memory of 1812	1984	rundll32.exe	29
PID 1984 wrote to memory of 1812	1984	rundll32.exe	29
PID 1984 wrote to memory of 1812	1984	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ba3a0d43a2afb3d4b9e24426123f5f5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ba3a0d43a2afb3d4b9e24426123f5f5_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 264
    3⤵
    - Program crash
    PID:1812

memory/1984-0-0x00000000006A0000-0x0000000000787000-memory.dmp

Filesize
924KB

Download
memory/1984-1-0x00000000006A0000-0x0000000000787000-memory.dmp

Filesize
924KB

Download