d0d44a05b19d61a78216bd442dbbce51fbedd9fe1c44e618ee414de65f89e3e6

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 14:41

Target

4a1b84419b1d374dc50358b5039d8564_JaffaCakes118.dll
Size

853KB
MD5

4a1b84419b1d374dc50358b5039d8564
SHA1

618dea4a4069e2b02fdae68683c89e88a0b8ce90
SHA256

d0d44a05b19d61a78216bd442dbbce51fbedd9fe1c44e618ee414de65f89e3e6
SHA512

bb16ea9cc1a5a7e425835461c7d684ee16652637649994aed4072b37267dd09d393f4bb1bdc37021479d4a51f27484c19bfb7d2adcb2b913b01b57c8bd0d4ce2
SSDEEP

24576:UIC6BZ/9/iR8uaHJxdAWmQJ4yRBMHk6asLE:NlT4+BOTE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2424	2168	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2168	1676	rundll32.exe	30
PID 1676 wrote to memory of 2168	1676	rundll32.exe	30
PID 1676 wrote to memory of 2168	1676	rundll32.exe	30
PID 1676 wrote to memory of 2168	1676	rundll32.exe	30
PID 1676 wrote to memory of 2168	1676	rundll32.exe	30
PID 1676 wrote to memory of 2168	1676	rundll32.exe	30
PID 1676 wrote to memory of 2168	1676	rundll32.exe	30
PID 2168 wrote to memory of 2424	2168	rundll32.exe	31
PID 2168 wrote to memory of 2424	2168	rundll32.exe	31
PID 2168 wrote to memory of 2424	2168	rundll32.exe	31
PID 2168 wrote to memory of 2424	2168	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a1b84419b1d374dc50358b5039d8564_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a1b84419b1d374dc50358b5039d8564_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 264
    3⤵
    - Program crash
    PID:2424

memory/2168-0-0x0000000001E90000-0x0000000001F70000-memory.dmp

Filesize
896KB

Download
memory/2168-1-0x0000000001E90000-0x0000000001F70000-memory.dmp

Filesize
896KB

Download