4d0e0697a522569989a088c56e5ee28e48a116e044baac7a84730e3229c169d5

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 23:38

Target

f6d1c0445a4a1338ba7775c1d470e649_JaffaCakes118.dll
Size

64KB
MD5

f6d1c0445a4a1338ba7775c1d470e649
SHA1

b161313b43f459c740a700af43844532cdb9b8f5
SHA256

4d0e0697a522569989a088c56e5ee28e48a116e044baac7a84730e3229c169d5
SHA512

1ff7b610916b39145d53dcf48b86e1506d86fea1c66f5db6d23ec40e31b46da386f9056041551c46f3ba40d953c5d6f8b2adf6f01e14b6731900df121155eaf0
SSDEEP

768:W/NjdCofK7BOHTS7s2WYx5Q0U4aQoFKGqQyW1StmNo8YlNZkVF9Nu:W/JYPOHTSA2WY0fKGqPSo1ZmQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2056	2828	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2828	2940	rundll32.exe	28
PID 2940 wrote to memory of 2828	2940	rundll32.exe	28
PID 2940 wrote to memory of 2828	2940	rundll32.exe	28
PID 2940 wrote to memory of 2828	2940	rundll32.exe	28
PID 2940 wrote to memory of 2828	2940	rundll32.exe	28
PID 2940 wrote to memory of 2828	2940	rundll32.exe	28
PID 2940 wrote to memory of 2828	2940	rundll32.exe	28
PID 2828 wrote to memory of 2056	2828	rundll32.exe	29
PID 2828 wrote to memory of 2056	2828	rundll32.exe	29
PID 2828 wrote to memory of 2056	2828	rundll32.exe	29
PID 2828 wrote to memory of 2056	2828	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6d1c0445a4a1338ba7775c1d470e649_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6d1c0445a4a1338ba7775c1d470e649_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 248
    3⤵
    - Program crash
    PID:2056