586d50124811b40e266e9882038308f593dfabe9214e35f4104177df8bbd6a87

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 04:10

Target

2108bd1c4860f25cb40a62f9f6e9f630_JaffaCakes118.dll
Size

1.1MB
MD5

2108bd1c4860f25cb40a62f9f6e9f630
SHA1

73462f78fb0e58f0868d4b6abd536e91bf383d90
SHA256

586d50124811b40e266e9882038308f593dfabe9214e35f4104177df8bbd6a87
SHA512

b662f4d5066822fa05b1461eca426aea2e62e70876db95ae34f442771bbbc0ef1129921740e1ada250337460df55b7dbfcd631ee4826dbaab4a697cf484d254f
SSDEEP

12288:KpHPdBG1Oefx1hHBH8W6buiwblDNhVvV5bKrCyuaXpH7I5rG+Ltg8:KFdBrefxtpGui4lD7ZV5+7AtLt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2128	2132	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 2132	1300	rundll32.exe	28
PID 1300 wrote to memory of 2132	1300	rundll32.exe	28
PID 1300 wrote to memory of 2132	1300	rundll32.exe	28
PID 1300 wrote to memory of 2132	1300	rundll32.exe	28
PID 1300 wrote to memory of 2132	1300	rundll32.exe	28
PID 1300 wrote to memory of 2132	1300	rundll32.exe	28
PID 1300 wrote to memory of 2132	1300	rundll32.exe	28
PID 2132 wrote to memory of 2128	2132	rundll32.exe	29
PID 2132 wrote to memory of 2128	2132	rundll32.exe	29
PID 2132 wrote to memory of 2128	2132	rundll32.exe	29
PID 2132 wrote to memory of 2128	2132	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2108bd1c4860f25cb40a62f9f6e9f630_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2108bd1c4860f25cb40a62f9f6e9f630_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 236
    3⤵
    - Program crash
    PID:2128

memory/2132-0-0x0000000010000000-0x000000001011D000-memory.dmp

Filesize
1.1MB

Download