998c36ae5a777074ae8fdffd60b6b41d98e9ca6682f3f3a3cfd27b66f8d26808

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 08:13

Target

4d7c80e26ea5bb818f51e25b9cb31edb_JaffaCakes118.dll
Size

347KB
MD5

4d7c80e26ea5bb818f51e25b9cb31edb
SHA1

dcd7a7cefeff0c843b7d438f00c40a3ee5f007a9
SHA256

998c36ae5a777074ae8fdffd60b6b41d98e9ca6682f3f3a3cfd27b66f8d26808
SHA512

78f3088ba5e129dfe63f6dbbb9eeccc5dcd903324750ddfcab1d9a3c98eceef8dc4700e5e3b09222dfe055d423fdaac7e6562684d8892d63d91f33550e25a2b5
SSDEEP

6144:HYz/VGZI9uh7zjXcmYEtGIBrSaR5PmtqWNG42HTWUncAWe7gpko8dJpQo1aaUW6C:Hwnu1IaSk6vqJpT7U

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
620	1356	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1356	3004	rundll32.exe	31
PID 3004 wrote to memory of 1356	3004	rundll32.exe	31
PID 3004 wrote to memory of 1356	3004	rundll32.exe	31
PID 3004 wrote to memory of 1356	3004	rundll32.exe	31
PID 3004 wrote to memory of 1356	3004	rundll32.exe	31
PID 3004 wrote to memory of 1356	3004	rundll32.exe	31
PID 3004 wrote to memory of 1356	3004	rundll32.exe	31
PID 1356 wrote to memory of 620	1356	rundll32.exe	32
PID 1356 wrote to memory of 620	1356	rundll32.exe	32
PID 1356 wrote to memory of 620	1356	rundll32.exe	32
PID 1356 wrote to memory of 620	1356	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d7c80e26ea5bb818f51e25b9cb31edb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d7c80e26ea5bb818f51e25b9cb31edb_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 224
    3⤵
    - Program crash
    PID:620

memory/1356-0-0x00000000001B0000-0x0000000000202000-memory.dmp

Filesize
328KB

Download
memory/1356-1-0x00000000003D0000-0x000000000042A000-memory.dmp

Filesize
360KB

Download
memory/1356-5-0x00000000001B0000-0x0000000000202000-memory.dmp

Filesize
328KB

Download