dd845191bbe284247dcde2bf4bcdd7de894c2b79090bdf8172fc780606fbe68a

Analysis

max time kernel
15s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 00:50

Target

5e6488cb856a51c95f4be08666008e81_JaffaCakes118.dll
Size

120KB
MD5

5e6488cb856a51c95f4be08666008e81
SHA1

63e5e8c76206c195ef773cbf0c336b80d09fc4d4
SHA256

dd845191bbe284247dcde2bf4bcdd7de894c2b79090bdf8172fc780606fbe68a
SHA512

b4a3baf9fa0cab0cc844dc30159797fb4ad1a01c57efe0ef61096e0774c6eeb43dca59a1402834f60181ea7a4927582734c8d6dd2aa828712c7467afcc1efe9b
SSDEEP

3072:vzKmDDD95qf7Ot8Tb4igc/woSIiBOwAF2ix:WmDhE6tiPX/woSIWix

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3060	3020	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 3020	2056	rundll32.exe	29
PID 2056 wrote to memory of 3020	2056	rundll32.exe	29
PID 2056 wrote to memory of 3020	2056	rundll32.exe	29
PID 2056 wrote to memory of 3020	2056	rundll32.exe	29
PID 2056 wrote to memory of 3020	2056	rundll32.exe	29
PID 2056 wrote to memory of 3020	2056	rundll32.exe	29
PID 2056 wrote to memory of 3020	2056	rundll32.exe	29
PID 3020 wrote to memory of 3060	3020	rundll32.exe	30
PID 3020 wrote to memory of 3060	3020	rundll32.exe	30
PID 3020 wrote to memory of 3060	3020	rundll32.exe	30
PID 3020 wrote to memory of 3060	3020	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e6488cb856a51c95f4be08666008e81_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e6488cb856a51c95f4be08666008e81_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 196
    3⤵
    - Program crash
    PID:3060

memory/3020-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/3020-0-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download