b80bc9820865464a211183a67d5aef80d5cb3dddbdc10a6a14ee7f9deea17346

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 23:49

Target

23e6a286815795b891cb1bf5514f3603_JaffaCakes118.dll
Size

273KB
MD5

23e6a286815795b891cb1bf5514f3603
SHA1

14d086ee12d3baab3d1c45827d3d1d69416a4746
SHA256

b80bc9820865464a211183a67d5aef80d5cb3dddbdc10a6a14ee7f9deea17346
SHA512

588787b27c94f55a13e2e6b5fc88ea838681d09b5c79b73bfa31b8c0fc51831423f603cf21cbf0a6f1c519cbb1c8c057677c30c81f6da131c53d065827c03af9
SSDEEP

6144:3HIVa2keFNxsmpMzIHcdiXkEphCDR7N+ySozLl8RetTKFgTQTnc:3o3NfMEyhDiySkUeoFgTQI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2944	2180	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2180	1700	rundll32.exe	28
PID 1700 wrote to memory of 2180	1700	rundll32.exe	28
PID 1700 wrote to memory of 2180	1700	rundll32.exe	28
PID 1700 wrote to memory of 2180	1700	rundll32.exe	28
PID 1700 wrote to memory of 2180	1700	rundll32.exe	28
PID 1700 wrote to memory of 2180	1700	rundll32.exe	28
PID 1700 wrote to memory of 2180	1700	rundll32.exe	28
PID 2180 wrote to memory of 2944	2180	rundll32.exe	29
PID 2180 wrote to memory of 2944	2180	rundll32.exe	29
PID 2180 wrote to memory of 2944	2180	rundll32.exe	29
PID 2180 wrote to memory of 2944	2180	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23e6a286815795b891cb1bf5514f3603_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23e6a286815795b891cb1bf5514f3603_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 248
    3⤵
    - Program crash
    PID:2944

memory/2180-5-0x00000000001E0000-0x0000000000226000-memory.dmp

Filesize
280KB

Download
memory/2180-4-0x0000000010000000-0x0000000010047000-memory.dmp

Filesize
284KB

Download
memory/2180-0-0x0000000001EE0000-0x0000000001F27000-memory.dmp

Filesize
284KB

Download