4b8a551f64a3deee2a69a3fb8c41b297e0516530b9fac6af94e233098de3e2fe

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 10:15

Target

159f8436142d7386ddd71b8fc2d96d57_JaffaCakes118.dll
Size

44KB
MD5

159f8436142d7386ddd71b8fc2d96d57
SHA1

ec1e0128a5e503f8225fbb2ba50750d65497d25d
SHA256

4b8a551f64a3deee2a69a3fb8c41b297e0516530b9fac6af94e233098de3e2fe
SHA512

c018aa18364d80e759a005fa6a2c09a9948d5a9d1e81daff7963221040913e3f35cae8963ab8b972d8397a9813c15a5b051654be920b48c5d602eb7179f3e05a
SSDEEP

768:aSjMqQtQbQhlL2raQUS8BapoJwtCSN/5ukrpZwdsju+WfAmU8lGRofd9VEj55a05:tjMqaQbQL484CShMkrpZ63VBU8Qefcb5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2796	1952	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 1952	2400	rundll32.exe	28
PID 2400 wrote to memory of 1952	2400	rundll32.exe	28
PID 2400 wrote to memory of 1952	2400	rundll32.exe	28
PID 2400 wrote to memory of 1952	2400	rundll32.exe	28
PID 2400 wrote to memory of 1952	2400	rundll32.exe	28
PID 2400 wrote to memory of 1952	2400	rundll32.exe	28
PID 2400 wrote to memory of 1952	2400	rundll32.exe	28
PID 1952 wrote to memory of 2796	1952	rundll32.exe	29
PID 1952 wrote to memory of 2796	1952	rundll32.exe	29
PID 1952 wrote to memory of 2796	1952	rundll32.exe	29
PID 1952 wrote to memory of 2796	1952	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\159f8436142d7386ddd71b8fc2d96d57_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\159f8436142d7386ddd71b8fc2d96d57_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 224
    3⤵
    - Program crash
    PID:2796

memory/1952-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download