32f80f5790cf20bc149df9f4fc949c5a3e5f0b0f95545284f78b2388d1b60abb

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 09:50

Target

62bea2811c42b6e993c61e2df88fd133_JaffaCakes118.dll
Size

268KB
MD5

62bea2811c42b6e993c61e2df88fd133
SHA1

82ddfb1d82262e7636da32859509332cd559b555
SHA256

32f80f5790cf20bc149df9f4fc949c5a3e5f0b0f95545284f78b2388d1b60abb
SHA512

2b634cbf108503ed4888f3e10103cf0ccee9df29d4506c29d0798171f1bdf500009ad5244f29fea2a6a82f579bfb92df7326206ff4f21042e6c42152688285c7
SSDEEP

6144:RxOJ+b7LC8fKXAphSv2L4vHh1v0ffCjbQmUpC09pkaWNro:RG4DfXy1v4999W

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2152	1292	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1292	2236	rundll32.exe	28
PID 2236 wrote to memory of 1292	2236	rundll32.exe	28
PID 2236 wrote to memory of 1292	2236	rundll32.exe	28
PID 2236 wrote to memory of 1292	2236	rundll32.exe	28
PID 2236 wrote to memory of 1292	2236	rundll32.exe	28
PID 2236 wrote to memory of 1292	2236	rundll32.exe	28
PID 2236 wrote to memory of 1292	2236	rundll32.exe	28
PID 1292 wrote to memory of 2152	1292	rundll32.exe	29
PID 1292 wrote to memory of 2152	1292	rundll32.exe	29
PID 1292 wrote to memory of 2152	1292	rundll32.exe	29
PID 1292 wrote to memory of 2152	1292	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\62bea2811c42b6e993c61e2df88fd133_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\62bea2811c42b6e993c61e2df88fd133_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 224
    3⤵
    - Program crash
    PID:2152

memory/1292-4-0x00000000006A0000-0x00000000006E3000-memory.dmp

Filesize
268KB

Download
memory/1292-0-0x00000000006F0000-0x0000000000738000-memory.dmp

Filesize
288KB

Download
memory/1292-5-0x00000000006A0000-0x00000000006E3000-memory.dmp

Filesize
268KB

Download