e5d024366c5b04a47d2f6801d47cab67398290bb27cbf530aaafde71cd6f9650

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 13:05

Target

161be61b2ec8d80dc4466900f585edf9_JaffaCakes118.dll
Size

66KB
MD5

161be61b2ec8d80dc4466900f585edf9
SHA1

7216a433e84f1f39699b63f9286c2ce25d36efcc
SHA256

e5d024366c5b04a47d2f6801d47cab67398290bb27cbf530aaafde71cd6f9650
SHA512

1dba65185cea576186294fb0b8fc59b5c8920d8eb50a4f231b740f7b5e2a1de93354e70404816590d8dd41c48542efc548cfa14d37e93c1ac152fb1361894169
SSDEEP

1536:0yfBOIoqQhhOr9/M7cW69Ue7kLt5bnZGcG+AK:/OIoqQhWqclkLnb9AK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2408	1940	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1940	1492	rundll32.exe	28
PID 1492 wrote to memory of 1940	1492	rundll32.exe	28
PID 1492 wrote to memory of 1940	1492	rundll32.exe	28
PID 1492 wrote to memory of 1940	1492	rundll32.exe	28
PID 1492 wrote to memory of 1940	1492	rundll32.exe	28
PID 1492 wrote to memory of 1940	1492	rundll32.exe	28
PID 1492 wrote to memory of 1940	1492	rundll32.exe	28
PID 1940 wrote to memory of 2408	1940	rundll32.exe	29
PID 1940 wrote to memory of 2408	1940	rundll32.exe	29
PID 1940 wrote to memory of 2408	1940	rundll32.exe	29
PID 1940 wrote to memory of 2408	1940	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\161be61b2ec8d80dc4466900f585edf9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\161be61b2ec8d80dc4466900f585edf9_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 228
    3⤵
    - Program crash
    PID:2408

memory/1940-0-0x0000000000180000-0x0000000000199000-memory.dmp

Filesize
100KB

Download
memory/1940-1-0x0000000000180000-0x0000000000199000-memory.dmp

Filesize
100KB

Download