307e7edb339b9cb422a0fc90b3519f75f65daa3580c02be0e37d4e3903328886

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 00:05

Target

4bfd3591c66b357713902403d4909390_JaffaCakes118.dll
Size

237KB
MD5

4bfd3591c66b357713902403d4909390
SHA1

3080c82abed6f20ccfc906eed352ac23f638b017
SHA256

307e7edb339b9cb422a0fc90b3519f75f65daa3580c02be0e37d4e3903328886
SHA512

dde6aff6e9434bc6eb40e2a072f10ee3bd4badc5afe2457326df0f1ef682f1a3ad0a81aee2dcd5eb7e06918c8a3e6327d542b92e503ada7fd091cdf65a5f556d
SSDEEP

3072:Tx7euwx79FBAd0zoCh2TjckJQU0hgRkaRSOoU0/KTqasu+PT7u/kiwwjK+eZf9eu:paVzaTF6HiIU0y2vPDiJKL8p2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2656	2080	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2080	2852	rundll32.exe	30
PID 2852 wrote to memory of 2080	2852	rundll32.exe	30
PID 2852 wrote to memory of 2080	2852	rundll32.exe	30
PID 2852 wrote to memory of 2080	2852	rundll32.exe	30
PID 2852 wrote to memory of 2080	2852	rundll32.exe	30
PID 2852 wrote to memory of 2080	2852	rundll32.exe	30
PID 2852 wrote to memory of 2080	2852	rundll32.exe	30
PID 2080 wrote to memory of 2656	2080	rundll32.exe	31
PID 2080 wrote to memory of 2656	2080	rundll32.exe	31
PID 2080 wrote to memory of 2656	2080	rundll32.exe	31
PID 2080 wrote to memory of 2656	2080	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bfd3591c66b357713902403d4909390_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bfd3591c66b357713902403d4909390_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 224
    3⤵
    - Program crash
    PID:2656

memory/2080-0-0x00000000001F0000-0x0000000000228000-memory.dmp

Filesize
224KB

Download
memory/2080-1-0x0000000000510000-0x000000000058C000-memory.dmp

Filesize
496KB

Download
memory/2080-5-0x00000000001F0000-0x0000000000228000-memory.dmp

Filesize
224KB

Download