f3d226f19e8e084e2d3d781340a40fa2d367d2e2e67aed14a771653018fb8d9d

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 11:54

Target

63217ea85385c33660fe1d615b8a5e48_JaffaCakes118.dll
Size

306KB
MD5

63217ea85385c33660fe1d615b8a5e48
SHA1

a1b7fdb4e905395cfc22920bd5f3a33419cfbfa3
SHA256

f3d226f19e8e084e2d3d781340a40fa2d367d2e2e67aed14a771653018fb8d9d
SHA512

cb55d4e84ce56b3f7de9a81dc7634418ed0364455cacfcea8214b53610797d412a1a4a16971c99071aa3b075fc481765c7a6ef8a9fc18dbf6c71f519fc898ed2
SSDEEP

6144:M8vxM4dUpeUxfk8DqRvI2HdmD9TWWtWXPT0suN71GCTf1dZoeeDcwynf:MxViTykwsyG4dLYcwsf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2736	2300	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2300	2672	rundll32.exe	30
PID 2672 wrote to memory of 2300	2672	rundll32.exe	30
PID 2672 wrote to memory of 2300	2672	rundll32.exe	30
PID 2672 wrote to memory of 2300	2672	rundll32.exe	30
PID 2672 wrote to memory of 2300	2672	rundll32.exe	30
PID 2672 wrote to memory of 2300	2672	rundll32.exe	30
PID 2672 wrote to memory of 2300	2672	rundll32.exe	30
PID 2300 wrote to memory of 2736	2300	rundll32.exe	31
PID 2300 wrote to memory of 2736	2300	rundll32.exe	31
PID 2300 wrote to memory of 2736	2300	rundll32.exe	31
PID 2300 wrote to memory of 2736	2300	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\63217ea85385c33660fe1d615b8a5e48_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\63217ea85385c33660fe1d615b8a5e48_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 224
    3⤵
    - Program crash
    PID:2736

memory/2300-0-0x00000000002D0000-0x000000000031C000-memory.dmp

Filesize
304KB

Download
memory/2300-1-0x0000000000760000-0x00000000007B6000-memory.dmp

Filesize
344KB

Download
memory/2300-5-0x00000000002D0000-0x000000000031C000-memory.dmp

Filesize
304KB

Download