f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 15:08

Target

f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081_JaffaCakes118.dll
Size

32KB
MD5

eef7981412be8ea459064d3090f4b3aa
SHA1

c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256

f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512

dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP

384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2800	2756	rundll32.exe	28
PID 2756 wrote to memory of 2800	2756	rundll32.exe	28
PID 2756 wrote to memory of 2800	2756	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2756 -s 84
  2⤵
  PID:2800