04c17af0298e2c9a1ee842f77961a3780d4c7cad4286a7c6d82782d574bb89ce

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 18:38

Target

3183bd1a9e844a7a9c6e3f2de8fd45aa_JaffaCakes118.dll
Size

84KB
MD5

3183bd1a9e844a7a9c6e3f2de8fd45aa
SHA1

d888d7b3538f8e8bdd9b8c54bb2d7569078d4c26
SHA256

04c17af0298e2c9a1ee842f77961a3780d4c7cad4286a7c6d82782d574bb89ce
SHA512

09076f26589cc675376b53699de67f5a052be2125a2ad44109fac1f9917b61abb4c966e1954b4f3960b35e059910320458c9975370b264643fb8b22683c797f2
SSDEEP

1536:UV88umswjsrrjgnx0+1ajlfT7hbE/QiKv5dGdOBKTuyjSdjf/kpt:UV83Psnxn1Ql3hbkQ35dGeKTuyjSdjXu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
748	1628	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1628	1948	rundll32.exe	30
PID 1948 wrote to memory of 1628	1948	rundll32.exe	30
PID 1948 wrote to memory of 1628	1948	rundll32.exe	30
PID 1948 wrote to memory of 1628	1948	rundll32.exe	30
PID 1948 wrote to memory of 1628	1948	rundll32.exe	30
PID 1948 wrote to memory of 1628	1948	rundll32.exe	30
PID 1948 wrote to memory of 1628	1948	rundll32.exe	30
PID 1628 wrote to memory of 748	1628	rundll32.exe	31
PID 1628 wrote to memory of 748	1628	rundll32.exe	31
PID 1628 wrote to memory of 748	1628	rundll32.exe	31
PID 1628 wrote to memory of 748	1628	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3183bd1a9e844a7a9c6e3f2de8fd45aa_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3183bd1a9e844a7a9c6e3f2de8fd45aa_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 208
    3⤵
    - Program crash
    PID:748

memory/1628-0-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1628-2-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1628-1-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download