9274c42c30b94882a6e3935211841ad1afd29f6610d00a37d8487efb2f98ef00

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 20:01

Target

4323a5fc10a32a4aa493f1e45df70e39_JaffaCakes118.dll
Size

116KB
MD5

4323a5fc10a32a4aa493f1e45df70e39
SHA1

a7b88c5418b768c63d2f98f671363fcb0b591dec
SHA256

9274c42c30b94882a6e3935211841ad1afd29f6610d00a37d8487efb2f98ef00
SHA512

a2693bb943e0e2c10d71536af7e5bc29cbb520da9262950026d3da62ae702b484f3d6bc2f2df0ae97b531ca825d61d1fc0de4188638972adee32abcba74da1fc
SSDEEP

3072:elQmnpO2VmZEJCPYVBuYroK9WbMDp54FUJaqu:eOBmjJCPqrIbQkmJa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2228	2904	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2904	1716	rundll32.exe	28
PID 1716 wrote to memory of 2904	1716	rundll32.exe	28
PID 1716 wrote to memory of 2904	1716	rundll32.exe	28
PID 1716 wrote to memory of 2904	1716	rundll32.exe	28
PID 1716 wrote to memory of 2904	1716	rundll32.exe	28
PID 1716 wrote to memory of 2904	1716	rundll32.exe	28
PID 1716 wrote to memory of 2904	1716	rundll32.exe	28
PID 2904 wrote to memory of 2228	2904	rundll32.exe	29
PID 2904 wrote to memory of 2228	2904	rundll32.exe	29
PID 2904 wrote to memory of 2228	2904	rundll32.exe	29
PID 2904 wrote to memory of 2228	2904	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4323a5fc10a32a4aa493f1e45df70e39_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4323a5fc10a32a4aa493f1e45df70e39_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 232
    3⤵
    - Program crash
    PID:2228

memory/2904-1-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/2904-0-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/2904-2-0x000000001005B000-0x000000001005C000-memory.dmp

Filesize
4KB

Download