3815f2f8149591f6014aa7d3503483e491d83eb381a543c25208b7cb9c3a2152

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 22:35

Target

603ff5c527679be101a32b3dd9c06cd3_JaffaCakes118.dll
Size

190KB
MD5

603ff5c527679be101a32b3dd9c06cd3
SHA1

6d4ee0ec9337dbf8d2ef00b88b3029727dde9e8f
SHA256

3815f2f8149591f6014aa7d3503483e491d83eb381a543c25208b7cb9c3a2152
SHA512

a96321bc3b7c478372b7cf074aad82c4d807b8397f1c7ea66c0ea420b7a5f4fbb98d0f4b76f9d61199f803e13691d292251dfe52b3b177c6eb7fd7a3d79eb1c3
SSDEEP

3072:nlOsgxdTMb1ZmoqV/X059nnFoMZymVxy8URFZtH4qiP8d98Wfat5bUod1lyjbLo7:nlOsgxl6ZmoYMnnFoOgRyqiPK9/C5b71

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2776	2412	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2412	2664	rundll32.exe	31
PID 2664 wrote to memory of 2412	2664	rundll32.exe	31
PID 2664 wrote to memory of 2412	2664	rundll32.exe	31
PID 2664 wrote to memory of 2412	2664	rundll32.exe	31
PID 2664 wrote to memory of 2412	2664	rundll32.exe	31
PID 2664 wrote to memory of 2412	2664	rundll32.exe	31
PID 2664 wrote to memory of 2412	2664	rundll32.exe	31
PID 2412 wrote to memory of 2776	2412	rundll32.exe	32
PID 2412 wrote to memory of 2776	2412	rundll32.exe	32
PID 2412 wrote to memory of 2776	2412	rundll32.exe	32
PID 2412 wrote to memory of 2776	2412	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\603ff5c527679be101a32b3dd9c06cd3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\603ff5c527679be101a32b3dd9c06cd3_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 224
    3⤵
    - Program crash
    PID:2776

memory/2412-4-0x0000000000210000-0x0000000000243000-memory.dmp

Filesize
204KB

Download
memory/2412-0-0x0000000000750000-0x00000000007AB000-memory.dmp

Filesize
364KB

Download
memory/2412-5-0x0000000000210000-0x0000000000243000-memory.dmp

Filesize
204KB

Download