ba419213e877189d70eb019753e1538f8fb3a1049475a640740f4af3d541c0e1

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 16:37

Target

3e16eca2d0bc30822fc161f95c6da43f_JaffaCakes118.dll
Size

120KB
MD5

3e16eca2d0bc30822fc161f95c6da43f
SHA1

6f5df282c426e0694878644882653b0952e666c9
SHA256

ba419213e877189d70eb019753e1538f8fb3a1049475a640740f4af3d541c0e1
SHA512

aa8f90f8644efb5d9c34b7263eaacc0b48e7199ebee5899b009b7cc3fd816209f90d603fa959f1fc410d6f1407615a6e9d4b1524a80446dcb6cf20c0b5ee465e
SSDEEP

3072:zszgyyG2A9+ZRB16o8uuQFcFp8TGhjL0uzly2TcHhnKIPpC7:zEyY+ZRqoR2pBhjLJz943O

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2004	2224	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2224	2488	rundll32.exe	30
PID 2488 wrote to memory of 2224	2488	rundll32.exe	30
PID 2488 wrote to memory of 2224	2488	rundll32.exe	30
PID 2488 wrote to memory of 2224	2488	rundll32.exe	30
PID 2488 wrote to memory of 2224	2488	rundll32.exe	30
PID 2488 wrote to memory of 2224	2488	rundll32.exe	30
PID 2488 wrote to memory of 2224	2488	rundll32.exe	30
PID 2224 wrote to memory of 2004	2224	rundll32.exe	31
PID 2224 wrote to memory of 2004	2224	rundll32.exe	31
PID 2224 wrote to memory of 2004	2224	rundll32.exe	31
PID 2224 wrote to memory of 2004	2224	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e16eca2d0bc30822fc161f95c6da43f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e16eca2d0bc30822fc161f95c6da43f_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 192
    3⤵
    - Program crash
    PID:2004

memory/2224-0-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download