561b732226621fa60e2a5f27f9f89f40e9fe06d1d215f8873b6612a734a0ac4e

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 18:28

Target

f884ced7aacce437148287c148be4f64_JaffaCakes118.dll
Size

24KB
MD5

f884ced7aacce437148287c148be4f64
SHA1

b69b1f0eb79e9d607758e2c47e9112669bcf7c49
SHA256

561b732226621fa60e2a5f27f9f89f40e9fe06d1d215f8873b6612a734a0ac4e
SHA512

27bb0145172c423fc572773531af30ef925d118dd663eda89778d65a1bb27fbd5023f0d1e7dbd544b3b3b7d021c0f182377c9be53dcf18e9176160d1bc161f79
SSDEEP

192:iHhDfT66xnxDRkbL8rBCBkJEdYi0me3F+LPIsB8Yx:iHh5xDRgL8r8mJEdYi0m7LP98Yx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2956	2948	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2948	2884	rundll32.exe	28
PID 2884 wrote to memory of 2948	2884	rundll32.exe	28
PID 2884 wrote to memory of 2948	2884	rundll32.exe	28
PID 2884 wrote to memory of 2948	2884	rundll32.exe	28
PID 2884 wrote to memory of 2948	2884	rundll32.exe	28
PID 2884 wrote to memory of 2948	2884	rundll32.exe	28
PID 2884 wrote to memory of 2948	2884	rundll32.exe	28
PID 2948 wrote to memory of 2956	2948	rundll32.exe	29
PID 2948 wrote to memory of 2956	2948	rundll32.exe	29
PID 2948 wrote to memory of 2956	2948	rundll32.exe	29
PID 2948 wrote to memory of 2956	2948	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f884ced7aacce437148287c148be4f64_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f884ced7aacce437148287c148be4f64_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 228
    3⤵
    - Program crash
    PID:2956