ad4356feeb3781b330ab0f1f94ac96c857004947c31b49cf335947454a39613c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 09:40

Target

389b91caab1611b1e2bf33c9bff68245_JaffaCakes118.dll
Size

233KB
MD5

389b91caab1611b1e2bf33c9bff68245
SHA1

faf468e51c7c3019b14426d5bfc51024359fb9c5
SHA256

ad4356feeb3781b330ab0f1f94ac96c857004947c31b49cf335947454a39613c
SHA512

c04523fe9d1b3dc23d6051a15be9885b461185284f6b606c3a00a3f702595cee9ed887b6596b7406414ce3fa32e47cfad7517c54befea25a5880f324b380640e
SSDEEP

6144:+im6l+198k5ccQXZHqISDsSwz5ZZpdkwFAGx6iFshHurWR1S:+l119UXpHqBsSwz5ZvawFAGx6iFspuaK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	2408	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2408	2540	rundll32.exe	30
PID 2540 wrote to memory of 2408	2540	rundll32.exe	30
PID 2540 wrote to memory of 2408	2540	rundll32.exe	30
PID 2540 wrote to memory of 2408	2540	rundll32.exe	30
PID 2540 wrote to memory of 2408	2540	rundll32.exe	30
PID 2540 wrote to memory of 2408	2540	rundll32.exe	30
PID 2540 wrote to memory of 2408	2540	rundll32.exe	30
PID 2408 wrote to memory of 2988	2408	rundll32.exe	31
PID 2408 wrote to memory of 2988	2408	rundll32.exe	31
PID 2408 wrote to memory of 2988	2408	rundll32.exe	31
PID 2408 wrote to memory of 2988	2408	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\389b91caab1611b1e2bf33c9bff68245_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\389b91caab1611b1e2bf33c9bff68245_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 224
    3⤵
    - Program crash
    PID:2988

memory/2408-4-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/2408-0-0x0000000000290000-0x00000000002CF000-memory.dmp

Filesize
252KB

Download