2da09c99a64aab933ada929334c58223118a7b41519371a8641f218e6788984c

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 05:17

Target

5f2a00119efc0ccc71fae9f8a52707ec_JaffaCakes118.dll
Size

133KB
MD5

5f2a00119efc0ccc71fae9f8a52707ec
SHA1

bc44b0ce1cec98a5ee5d487aec52c8eeea1d9d76
SHA256

2da09c99a64aab933ada929334c58223118a7b41519371a8641f218e6788984c
SHA512

9249f0e8fbc5271f61ca0db2b3301cd4c1ee958e8793a34fe124082064aabd7221918646409c18eeec7b64511ce0e68229f8c8971b9dc7ff2f5958e028f1eeb3
SSDEEP

3072:tgbLo93/nR9QYfB6teFDIOSOaqY/kMsqb4P9X3S:tsLQp9QyB6teFDIOed/kMsqM1y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2312	2140	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2140	2136	rundll32.exe	30
PID 2136 wrote to memory of 2140	2136	rundll32.exe	30
PID 2136 wrote to memory of 2140	2136	rundll32.exe	30
PID 2136 wrote to memory of 2140	2136	rundll32.exe	30
PID 2136 wrote to memory of 2140	2136	rundll32.exe	30
PID 2136 wrote to memory of 2140	2136	rundll32.exe	30
PID 2136 wrote to memory of 2140	2136	rundll32.exe	30
PID 2140 wrote to memory of 2312	2140	rundll32.exe	31
PID 2140 wrote to memory of 2312	2140	rundll32.exe	31
PID 2140 wrote to memory of 2312	2140	rundll32.exe	31
PID 2140 wrote to memory of 2312	2140	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f2a00119efc0ccc71fae9f8a52707ec_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f2a00119efc0ccc71fae9f8a52707ec_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 284
    3⤵
    - Program crash
    PID:2312

memory/2140-0-0x0000000000280000-0x00000000002A6000-memory.dmp

Filesize
152KB

Download
memory/2140-1-0x0000000000280000-0x00000000002A6000-memory.dmp

Filesize
152KB

Download