b082508aceaeb48fc9e53f549aadba6b4fedb1e1722dcb0cbd2bb5a9529d5d82

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 02:08

Target

47c5f6e9be3f2ad58c6c6408d468eec8_JaffaCakes118.dll
Size

165KB
MD5

47c5f6e9be3f2ad58c6c6408d468eec8
SHA1

b79908c915826dbfd76a551cc32dda6140697a88
SHA256

b082508aceaeb48fc9e53f549aadba6b4fedb1e1722dcb0cbd2bb5a9529d5d82
SHA512

696e6998b825e759366c41c288af637aeed1e574c7447d08d8c6f54c4adbe6596e318df062f4178d95c3a8561b49411836ededd335463c76d554416c1a9ca39f
SSDEEP

3072:VX36n99ARCYlpezLH67yPJf3ksTH8/BL7xOxo/46TnX7I9YU4:h699ARC9XHc6lksTA7xOQ4H9n

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2844	1676	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 1676	884	rundll32.exe	30
PID 884 wrote to memory of 1676	884	rundll32.exe	30
PID 884 wrote to memory of 1676	884	rundll32.exe	30
PID 884 wrote to memory of 1676	884	rundll32.exe	30
PID 884 wrote to memory of 1676	884	rundll32.exe	30
PID 884 wrote to memory of 1676	884	rundll32.exe	30
PID 884 wrote to memory of 1676	884	rundll32.exe	30
PID 1676 wrote to memory of 2844	1676	rundll32.exe	31
PID 1676 wrote to memory of 2844	1676	rundll32.exe	31
PID 1676 wrote to memory of 2844	1676	rundll32.exe	31
PID 1676 wrote to memory of 2844	1676	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47c5f6e9be3f2ad58c6c6408d468eec8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\47c5f6e9be3f2ad58c6c6408d468eec8_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 224
    3⤵
    - Program crash
    PID:2844

memory/1676-0-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download