59964b82d32abe523f7ac1cb79cc6f93483b88f55b63ecd81bb00ac938e378f3

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 21:48

Target

321a7d4bdc919a825749c0e4064129da_JaffaCakes118.dll
Size

48KB
MD5

321a7d4bdc919a825749c0e4064129da
SHA1

1545f141be6aa9d320f7f40af4760d66f162c962
SHA256

59964b82d32abe523f7ac1cb79cc6f93483b88f55b63ecd81bb00ac938e378f3
SHA512

57eff76b77b57c728a98c8700917b2ee86bd4a6043d1d83e982e6c69c0c152cc86166ebc1fe6e13e7536a4bd45739ca77635c6b8a5f5a5527851e5589abe51af
SSDEEP

768:K8fV/pK5iLQVxGDJvS+WIlo2MPFnuHChSVoL/95GSczyn9zXo91kA:/fV/BLCGDJvg2gYCnGScu9bo1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1840	904	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 904	2396	rundll32.exe	30
PID 2396 wrote to memory of 904	2396	rundll32.exe	30
PID 2396 wrote to memory of 904	2396	rundll32.exe	30
PID 2396 wrote to memory of 904	2396	rundll32.exe	30
PID 2396 wrote to memory of 904	2396	rundll32.exe	30
PID 2396 wrote to memory of 904	2396	rundll32.exe	30
PID 2396 wrote to memory of 904	2396	rundll32.exe	30
PID 904 wrote to memory of 1840	904	rundll32.exe	31
PID 904 wrote to memory of 1840	904	rundll32.exe	31
PID 904 wrote to memory of 1840	904	rundll32.exe	31
PID 904 wrote to memory of 1840	904	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\321a7d4bdc919a825749c0e4064129da_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\321a7d4bdc919a825749c0e4064129da_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 228
    3⤵
    - Program crash
    PID:1840

memory/904-0-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/904-1-0x0000000000250000-0x0000000000326000-memory.dmp

Filesize
856KB

Download