5b5f1beecfa284f9d9062f3a66ae357ac49f3aeebed917775bf265771c886e1b

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/04/2024, 19:03

Target

c0438156fb20ed808ea0cab040927d23_JaffaCakes118.dll
Size

241KB
MD5

c0438156fb20ed808ea0cab040927d23
SHA1

e3a0dfc09b6d277b92f9bab9d294922319db4a48
SHA256

5b5f1beecfa284f9d9062f3a66ae357ac49f3aeebed917775bf265771c886e1b
SHA512

ab052da0a9fba08e0f515d98877bfc1c471c0b63ba6ba13d34c27d80595369e0e122dad80b4131bf887e0efe35df0501e90eb59e906803beda439dc37dad6ffa
SSDEEP

1536:sC0eZ1t5HnwfdOFSw0BMwBfXO+gBrtwjVod5q/VyTt1xb1WWrDp0rtFLOt:s7z0wBftgBrCGaVyTt1xbTrSBFLOt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2992	2948	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2948	1896	rundll32.exe	28
PID 1896 wrote to memory of 2948	1896	rundll32.exe	28
PID 1896 wrote to memory of 2948	1896	rundll32.exe	28
PID 1896 wrote to memory of 2948	1896	rundll32.exe	28
PID 1896 wrote to memory of 2948	1896	rundll32.exe	28
PID 1896 wrote to memory of 2948	1896	rundll32.exe	28
PID 1896 wrote to memory of 2948	1896	rundll32.exe	28
PID 2948 wrote to memory of 2992	2948	rundll32.exe	29
PID 2948 wrote to memory of 2992	2948	rundll32.exe	29
PID 2948 wrote to memory of 2992	2948	rundll32.exe	29
PID 2948 wrote to memory of 2992	2948	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0438156fb20ed808ea0cab040927d23_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0438156fb20ed808ea0cab040927d23_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 196
    3⤵
    - Program crash
    PID:2992