6541bd5068d88d4e2e337a184e74fdee50358c3ed27e828e91b8efa3280073cd

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 13:14

Target

f811cdeadb45913782828655d321381c_JaffaCakes118.dll
Size

177KB
MD5

f811cdeadb45913782828655d321381c
SHA1

94b8b05ad1349b505735690a32d9576c05e59522
SHA256

6541bd5068d88d4e2e337a184e74fdee50358c3ed27e828e91b8efa3280073cd
SHA512

fb87169be14c35dd20d0f8cdfd9096867e111e49ea718b878b82b93b3d93678d89f23fb82d9822682966714fc8ae9aaf399af043067f3b11ff468dd0f61658ab
SSDEEP

3072:4uhE6zRkEfal09DStvh4LwDJKATV+cM/cxqi/n5DPyQf7MXph+lcuf:4uh/nD44A+cS0q4JMXph+lz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2232	1792	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1792	848	rundll32.exe	28
PID 848 wrote to memory of 1792	848	rundll32.exe	28
PID 848 wrote to memory of 1792	848	rundll32.exe	28
PID 848 wrote to memory of 1792	848	rundll32.exe	28
PID 848 wrote to memory of 1792	848	rundll32.exe	28
PID 848 wrote to memory of 1792	848	rundll32.exe	28
PID 848 wrote to memory of 1792	848	rundll32.exe	28
PID 1792 wrote to memory of 2232	1792	rundll32.exe	29
PID 1792 wrote to memory of 2232	1792	rundll32.exe	29
PID 1792 wrote to memory of 2232	1792	rundll32.exe	29
PID 1792 wrote to memory of 2232	1792	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f811cdeadb45913782828655d321381c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f811cdeadb45913782828655d321381c_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 272
    3⤵
    - Program crash
    PID:2232