4854078555fd777499620010bea23a2b36f7723e2f06bc5da945abcc6c4f3fa5

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 04:23

Target

f97ed045e4fee87d86ed955a8362d770_JaffaCakes118.dll
Size

28KB
MD5

f97ed045e4fee87d86ed955a8362d770
SHA1

a8cccd1fb667b42ca216ec17e4700f593268d5da
SHA256

4854078555fd777499620010bea23a2b36f7723e2f06bc5da945abcc6c4f3fa5
SHA512

e040f6009ce5f4f5046d2631101bbbc74f0aef66de002b83b10e0c4e3acc256a3c90c2612eea13ca692c915efa56a591030944cdd79e8c8bb6c23a9d59bec326
SSDEEP

384:a5W/X3lJCPENmw7cI9a2iVFDczFE18aAoi3aSwW7EvTia2dq1wcX+hBJ+JjEw:a5SX1YEN5zgDczFm8adSwa024wcXebM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1904	2036	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2036	2364	rundll32.exe	28
PID 2364 wrote to memory of 2036	2364	rundll32.exe	28
PID 2364 wrote to memory of 2036	2364	rundll32.exe	28
PID 2364 wrote to memory of 2036	2364	rundll32.exe	28
PID 2364 wrote to memory of 2036	2364	rundll32.exe	28
PID 2364 wrote to memory of 2036	2364	rundll32.exe	28
PID 2364 wrote to memory of 2036	2364	rundll32.exe	28
PID 2036 wrote to memory of 1904	2036	rundll32.exe	29
PID 2036 wrote to memory of 1904	2036	rundll32.exe	29
PID 2036 wrote to memory of 1904	2036	rundll32.exe	29
PID 2036 wrote to memory of 1904	2036	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f97ed045e4fee87d86ed955a8362d770_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f97ed045e4fee87d86ed955a8362d770_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 232
    3⤵
    - Program crash
    PID:1904