4c889f5fdffe7b6145b59232c1da5966bdeb57b6d21f38eebe12015903d456f6

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-04-2024 21:06

Target

ef81a01e614a3a7c7a06171e8ec463b6_JaffaCakes118.dll
Size

135KB
MD5

ef81a01e614a3a7c7a06171e8ec463b6
SHA1

499cceeeb6485b34233b85fdbd5e26397423f0a7
SHA256

4c889f5fdffe7b6145b59232c1da5966bdeb57b6d21f38eebe12015903d456f6
SHA512

62f6dfe15b5b84ee773d0981de5a73734baeb8d7c6407959736387bed9e5655abfc62bc1febe67e6ea5176365ec0f8f8212cf177a4680c9236bf39cd546db9cd
SSDEEP

1536:fS0nQkNkx7AeJRhNUoCthFYJmw44uh9nVJUWlDYnyrCo5CqydiEz1t4PpZnM+zgV:zNelNEvKWZYKika1t4PpZ/bVn7Ch

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2500	3056	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 3056	2116	rundll32.exe	27
PID 2116 wrote to memory of 3056	2116	rundll32.exe	27
PID 2116 wrote to memory of 3056	2116	rundll32.exe	27
PID 2116 wrote to memory of 3056	2116	rundll32.exe	27
PID 2116 wrote to memory of 3056	2116	rundll32.exe	27
PID 2116 wrote to memory of 3056	2116	rundll32.exe	27
PID 2116 wrote to memory of 3056	2116	rundll32.exe	27
PID 3056 wrote to memory of 2500	3056	rundll32.exe	28
PID 3056 wrote to memory of 2500	3056	rundll32.exe	28
PID 3056 wrote to memory of 2500	3056	rundll32.exe	28
PID 3056 wrote to memory of 2500	3056	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef81a01e614a3a7c7a06171e8ec463b6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef81a01e614a3a7c7a06171e8ec463b6_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 224
    3⤵
    - Program crash
    PID:2500