eb1771c5d37223af8296559b9e3f7e4183df3e77d27a4c3460f57ab022bc35e2

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07-07-2024 23:29

Target

2a2be84507b43aaa4ca2e054d23a5433_JaffaCakes118.dll
Size

148KB
MD5

2a2be84507b43aaa4ca2e054d23a5433
SHA1

ffd600dbd298c2aea7d800f0ca83c911cb481990
SHA256

eb1771c5d37223af8296559b9e3f7e4183df3e77d27a4c3460f57ab022bc35e2
SHA512

fcdd53db50756bd8d5e82b19a83220b44c3edb839f1febe93b761403c44dbf2de8aed1e1c2efef99666cd1eab7ec62219f72dc8aa385370204600b4d719c3aa9
SSDEEP

1536:OFb/gIdEvntTRoxIzDpDLh5CIBuZxZVKtPzsrQPodnItC7dDhXpQ:OFVd8nRRoizFXhoIB2ZVmC3lbHS

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
972	rundll32mgr.exe

Loads dropped DLL 9 IoCs

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2868	2328	WerFault.exe	29
1436	972	WerFault.exe	30

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2328	3068	rundll32.exe	29
PID 3068 wrote to memory of 2328	3068	rundll32.exe	29
PID 3068 wrote to memory of 2328	3068	rundll32.exe	29
PID 3068 wrote to memory of 2328	3068	rundll32.exe	29
PID 3068 wrote to memory of 2328	3068	rundll32.exe	29
PID 3068 wrote to memory of 2328	3068	rundll32.exe	29
PID 3068 wrote to memory of 2328	3068	rundll32.exe	29
PID 2328 wrote to memory of 972	2328	rundll32.exe	30
PID 2328 wrote to memory of 972	2328	rundll32.exe	30
PID 2328 wrote to memory of 972	2328	rundll32.exe	30
PID 2328 wrote to memory of 972	2328	rundll32.exe	30
PID 2328 wrote to memory of 2868	2328	rundll32.exe	32
PID 972 wrote to memory of 1436	972	rundll32mgr.exe	31
PID 972 wrote to memory of 1436	972	rundll32mgr.exe	31
PID 972 wrote to memory of 1436	972	rundll32mgr.exe	31
PID 2328 wrote to memory of 2868	2328	rundll32.exe	32
PID 972 wrote to memory of 1436	972	rundll32mgr.exe	31
PID 2328 wrote to memory of 2868	2328	rundll32.exe	32
PID 2328 wrote to memory of 2868	2328	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a2be84507b43aaa4ca2e054d23a5433_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a2be84507b43aaa4ca2e054d23a5433_JaffaCakes118.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:972
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 100
      4⤵
      Loads dropped DLL
      Program crash
      PID:1436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 228
    3⤵
    - Program crash
    PID:2868

\Windows\SysWOW64\rundll32mgr.exe

Filesize
103KB

MD5
0ff8c1c8de1f818a51512f4d894e30d1

SHA1
bd99a343ea5ca5ebdd7207651478a8425054716a

SHA256
7cc54785e229b1605103e3219969939eb80f106e9edca3cb380917ac33526d28

SHA512
da23767aa25ba5c1bb55c338fa82b1b60853c83fd1e4af28cc023fdd1405b46717bc58137d7bfe7a3a581dcd23de0520ab6ace88434b8cf35b3a0278f516dfd2

Download Submit
memory/2328-1-0x000000006D140000-0x000000006D165000-memory.dmp

Filesize
148KB

Download