7df7ebf90ee2c670fdbbbecc1a206f3eb9b090580c18897e61bf98d2ee8bcf1b

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 12:26

Target

3d5e3b47c42b1c6078badfae33aa8326_JaffaCakes118.dll
Size

679KB
MD5

3d5e3b47c42b1c6078badfae33aa8326
SHA1

380932187626ab9f61be4fc4cdc395f80192c954
SHA256

7df7ebf90ee2c670fdbbbecc1a206f3eb9b090580c18897e61bf98d2ee8bcf1b
SHA512

e5644a4f24f611e136388e7619879967d248475c07713c88516758d8e3b910171082ad9eebe1d65c2dd06ba5cf2af0826b50a5855428ed143ae188c4fc9f4df0
SSDEEP

12288:se4x/nF+8PW5AJLoS8e9ub6Kt/idEuzgUW9NPdMKjF5MbHvt6rO+JXodWI:z6/Y8PW5AJLF8Lb6ShuzMDPdMVv4rO+j

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2780	1680	WerFault.exe	31

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	rundll32.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1680	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 1680	2400	rundll32.exe	31
PID 2400 wrote to memory of 1680	2400	rundll32.exe	31
PID 2400 wrote to memory of 1680	2400	rundll32.exe	31
PID 2400 wrote to memory of 1680	2400	rundll32.exe	31
PID 2400 wrote to memory of 1680	2400	rundll32.exe	31
PID 2400 wrote to memory of 1680	2400	rundll32.exe	31
PID 2400 wrote to memory of 1680	2400	rundll32.exe	31
PID 1680 wrote to memory of 2780	1680	rundll32.exe	32
PID 1680 wrote to memory of 2780	1680	rundll32.exe	32
PID 1680 wrote to memory of 2780	1680	rundll32.exe	32
PID 1680 wrote to memory of 2780	1680	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d5e3b47c42b1c6078badfae33aa8326_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d5e3b47c42b1c6078badfae33aa8326_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 244
    3⤵
    - Program crash
    PID:2780

memory/1680-0-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/1680-1-0x0000000013140000-0x00000000131F0000-memory.dmp

Filesize
704KB

Download
memory/1680-3-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download