5e80a7cbc1f9c1f7de058cd2a82e6094eb32a9f5ec2e24b5ec3af3bcbfc974f3

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 20:54

Target

4b5b958a6e9eaafdb674757f72076356_JaffaCakes118.dll
Size

115KB
MD5

4b5b958a6e9eaafdb674757f72076356
SHA1

e002edf86517ff566b636006db23038aa3055f2a
SHA256

5e80a7cbc1f9c1f7de058cd2a82e6094eb32a9f5ec2e24b5ec3af3bcbfc974f3
SHA512

aa957758e66f5e1eb795286514ce9c4bd370496fdde319981566bda7e96f0d2441b3810e6825433cd0ae096184dc81c511fb1a2ffeec6b931f563bd4eda4756b
SSDEEP

3072:Y79z35gQGjjZOD/KQGFNF3Nq6wK3UCfdg6e:CV35gPj+KQGx3UxK37y6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2684	2864	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2864	2324	rundll32.exe	30
PID 2324 wrote to memory of 2864	2324	rundll32.exe	30
PID 2324 wrote to memory of 2864	2324	rundll32.exe	30
PID 2324 wrote to memory of 2864	2324	rundll32.exe	30
PID 2324 wrote to memory of 2864	2324	rundll32.exe	30
PID 2324 wrote to memory of 2864	2324	rundll32.exe	30
PID 2324 wrote to memory of 2864	2324	rundll32.exe	30
PID 2864 wrote to memory of 2684	2864	rundll32.exe	31
PID 2864 wrote to memory of 2684	2864	rundll32.exe	31
PID 2864 wrote to memory of 2684	2864	rundll32.exe	31
PID 2864 wrote to memory of 2684	2864	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b5b958a6e9eaafdb674757f72076356_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b5b958a6e9eaafdb674757f72076356_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 228
    3⤵
    - Program crash
    PID:2684

memory/2864-0-0x0000000000160000-0x000000000016F000-memory.dmp

Filesize
60KB

Download
memory/2864-1-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/2864-6-0x0000000000160000-0x000000000016F000-memory.dmp

Filesize
60KB

Download
memory/2864-5-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/2864-9-0x0000000000160000-0x000000000016F000-memory.dmp

Filesize
60KB

Download