2f58a869711d2b28e6ecaac25cc2166daa46f7adfb719b7dd334e01c1474ca9b

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 07:08

Target

f782fa626b0c53d9cca2fbb29a65f23f_JaffaCakes118.dll
Size

160KB
MD5

f782fa626b0c53d9cca2fbb29a65f23f
SHA1

9fabc6c255ea94262b6339e4b5949174afd30114
SHA256

2f58a869711d2b28e6ecaac25cc2166daa46f7adfb719b7dd334e01c1474ca9b
SHA512

2d023aa899d5025631534489c6a13de071113f36ae2ab32d53c833c749d262019f3c3bd7961f2da12753e389bab92f4bda429662dec77552a13c825258af9e18
SSDEEP

3072:SXZC1fhEIosP/HMP7kUj6IXE6i1xRqLCJVQPyR:uC1fWIpP/H67kU+I06i1DB

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2896 2216 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2896	2216	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1256 wrote to memory of 2216	1256	rundll32.exe	rundll32.exe
PID 1256 wrote to memory of 2216	1256	rundll32.exe	rundll32.exe
PID 1256 wrote to memory of 2216	1256	rundll32.exe	rundll32.exe
PID 1256 wrote to memory of 2216	1256	rundll32.exe	rundll32.exe
PID 1256 wrote to memory of 2216	1256	rundll32.exe	rundll32.exe
PID 1256 wrote to memory of 2216	1256	rundll32.exe	rundll32.exe
PID 1256 wrote to memory of 2216	1256	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 2896	2216	rundll32.exe	WerFault.exe
PID 2216 wrote to memory of 2896	2216	rundll32.exe	WerFault.exe
PID 2216 wrote to memory of 2896	2216	rundll32.exe	WerFault.exe
PID 2216 wrote to memory of 2896	2216	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f782fa626b0c53d9cca2fbb29a65f23f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f782fa626b0c53d9cca2fbb29a65f23f_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 224
    3⤵
    - Program crash
    PID:2896