a33c2ecdc1e4e5864d5e28c5994e30e9ac4f34575ea0821e3d7795c39862a48a

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 03:09

Target

f4e778113471105ab936264bdd5a3919_JaffaCakes118.dll
Size

72KB
MD5

f4e778113471105ab936264bdd5a3919
SHA1

95b999e06c75eb4750ec128d54e1581ccf9c0823
SHA256

a33c2ecdc1e4e5864d5e28c5994e30e9ac4f34575ea0821e3d7795c39862a48a
SHA512

d80f21111fe3f37108bb96f8269e62f2e5862aad3694f7a8c2b995499b586e0d0808969fd3f1f8b1a5039cbb57d785f235043a34eb5c2032fc0681787fa53809
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2208	2024	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2024	2304	rundll32.exe	28
PID 2304 wrote to memory of 2024	2304	rundll32.exe	28
PID 2304 wrote to memory of 2024	2304	rundll32.exe	28
PID 2304 wrote to memory of 2024	2304	rundll32.exe	28
PID 2304 wrote to memory of 2024	2304	rundll32.exe	28
PID 2304 wrote to memory of 2024	2304	rundll32.exe	28
PID 2304 wrote to memory of 2024	2304	rundll32.exe	28
PID 2024 wrote to memory of 2208	2024	rundll32.exe	29
PID 2024 wrote to memory of 2208	2024	rundll32.exe	29
PID 2024 wrote to memory of 2208	2024	rundll32.exe	29
PID 2024 wrote to memory of 2208	2024	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4e778113471105ab936264bdd5a3919_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4e778113471105ab936264bdd5a3919_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 224
    3⤵
    - Program crash
    PID:2208