cb448fbc340a23d59c158ce7849d2e074bf30fb2fa8c1c3d2fd6e5001801b4da

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 22:03

Target

3ae2c4990ddd0783376e38e2fbfc5602_JaffaCakes118.dll
Size

18KB
MD5

3ae2c4990ddd0783376e38e2fbfc5602
SHA1

486ab61ae9bf520f00fb6ea5600fc16f4f195cac
SHA256

cb448fbc340a23d59c158ce7849d2e074bf30fb2fa8c1c3d2fd6e5001801b4da
SHA512

e06f9f85aebc78392a2997f9d1cfd4f5cfd94b9481f87db91083de8a3116790eb1aef47dfd4e98d465ba8553d18d48678184cf3d9f1b0891d9c566bb1c84126f
SSDEEP

384:FYnw36QBMRL1bHxWhOqlNhgfo0qFmpELoKTm8AS1OFpm:336/R1xGlz0nqF7Lod8gFE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1972	2200	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2200	1792	rundll32.exe	30
PID 1792 wrote to memory of 2200	1792	rundll32.exe	30
PID 1792 wrote to memory of 2200	1792	rundll32.exe	30
PID 1792 wrote to memory of 2200	1792	rundll32.exe	30
PID 1792 wrote to memory of 2200	1792	rundll32.exe	30
PID 1792 wrote to memory of 2200	1792	rundll32.exe	30
PID 1792 wrote to memory of 2200	1792	rundll32.exe	30
PID 2200 wrote to memory of 1972	2200	rundll32.exe	31
PID 2200 wrote to memory of 1972	2200	rundll32.exe	31
PID 2200 wrote to memory of 1972	2200	rundll32.exe	31
PID 2200 wrote to memory of 1972	2200	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ae2c4990ddd0783376e38e2fbfc5602_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ae2c4990ddd0783376e38e2fbfc5602_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 232
    3⤵
    - Program crash
    PID:1972

memory/2200-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/2200-2-0x0000000010016000-0x0000000010017000-memory.dmp

Filesize
4KB

Download
memory/2200-1-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download