2e8644302a0fb24e0a2721a3fa7548e0cfce2c5d6fac918440733a457b977176

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 00:14

Target

36f857084badb877038fca24a059a705_JaffaCakes118.dll
Size

18KB
MD5

36f857084badb877038fca24a059a705
SHA1

8b946734f7954265160caefda3c0330a8fa9e3c8
SHA256

2e8644302a0fb24e0a2721a3fa7548e0cfce2c5d6fac918440733a457b977176
SHA512

e74aa0e35885924f66cad8c495c119a1c20b0b0e3529e7ec6c70ab789783480a8c2c87ea4b245b20e66320abb6c709235a5835209e94b5782b7eb32c171ca7a6
SSDEEP

384:nI+pajRhnvTYueJdof47qOjQ8gU2/TpDAN7/hk:HOnbYuIyqjSU6TpDg/

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\windds32.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\windds32.dll	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1920	3044	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3044	rundll32.exe
3044	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 3044	2368	rundll32.exe	30
PID 2368 wrote to memory of 3044	2368	rundll32.exe	30
PID 2368 wrote to memory of 3044	2368	rundll32.exe	30
PID 2368 wrote to memory of 3044	2368	rundll32.exe	30
PID 2368 wrote to memory of 3044	2368	rundll32.exe	30
PID 2368 wrote to memory of 3044	2368	rundll32.exe	30
PID 2368 wrote to memory of 3044	2368	rundll32.exe	30
PID 3044 wrote to memory of 1920	3044	rundll32.exe	31
PID 3044 wrote to memory of 1920	3044	rundll32.exe	31
PID 3044 wrote to memory of 1920	3044	rundll32.exe	31
PID 3044 wrote to memory of 1920	3044	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36f857084badb877038fca24a059a705_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36f857084badb877038fca24a059a705_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 224
    3⤵
    - Program crash
    PID:1920

memory/3044-2-0x000000001000D000-0x000000001000E000-memory.dmp

Filesize
4KB

Download
memory/3044-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download