c993d4c5fbc845c4f733ec67638d2b050c174f16e469a5f1b59ecf79f658d96d

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 02:11

Target

0bfde1f3e489fb2d5c51216aded97bb1_JaffaCakes118.dll
Size

823KB
MD5

0bfde1f3e489fb2d5c51216aded97bb1
SHA1

aec56a260d5c75e262ae5b14d4f358121eac4d93
SHA256

c993d4c5fbc845c4f733ec67638d2b050c174f16e469a5f1b59ecf79f658d96d
SHA512

81c8cd7f437c5dde3e7daccfbcc21b71bebc56f3f423ef44bdf3bce35f733481407fe32f50a7ed7ab6c3edd1e14001dac97b706bc6380818aad78ccb97e2e691
SSDEEP

24576:wBRjFO4tnI+DLWmCS9DfWmQihtH7e2ZkShAiZ:gFnb/97eihr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2520	1744	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 1744	2340	rundll32.exe	28
PID 2340 wrote to memory of 1744	2340	rundll32.exe	28
PID 2340 wrote to memory of 1744	2340	rundll32.exe	28
PID 2340 wrote to memory of 1744	2340	rundll32.exe	28
PID 2340 wrote to memory of 1744	2340	rundll32.exe	28
PID 2340 wrote to memory of 1744	2340	rundll32.exe	28
PID 2340 wrote to memory of 1744	2340	rundll32.exe	28
PID 1744 wrote to memory of 2520	1744	rundll32.exe	29
PID 1744 wrote to memory of 2520	1744	rundll32.exe	29
PID 1744 wrote to memory of 2520	1744	rundll32.exe	29
PID 1744 wrote to memory of 2520	1744	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bfde1f3e489fb2d5c51216aded97bb1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bfde1f3e489fb2d5c51216aded97bb1_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 264
    3⤵
    - Program crash
    PID:2520

memory/1744-0-0x0000000000760000-0x0000000000839000-memory.dmp

Filesize
868KB

Download
memory/1744-1-0x0000000000760000-0x0000000000839000-memory.dmp

Filesize
868KB

Download