93b724536b967684749bea31324efe53ad6c82af3a364e40b14850c6eb85f954

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 14:49

Target

fa892d6eed0066286bb93df739ac9a3e_JaffaCakes118.dll
Size

18KB
MD5

fa892d6eed0066286bb93df739ac9a3e
SHA1

5efeae9253f740401a84399065962b1778150d5b
SHA256

93b724536b967684749bea31324efe53ad6c82af3a364e40b14850c6eb85f954
SHA512

e4782e3d2ef0fa05d5ab0fa138f70c2aeeeee05fb3c206aab73b850f749d30fbfd3e1ae9ab5e0f7dec2f6c10ccb1f49a9bebc3e39ff2b1b4e5b55d3015a66537
SSDEEP

384:+5MPeShoDsI/CRraShz4dMCyqKzkW9c8ZrwzCFUOUGvHaWVbk:++Pzo4M0raG47yLkW9curwzCyFG/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2456	2552	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2552	1952	rundll32.exe	28
PID 1952 wrote to memory of 2552	1952	rundll32.exe	28
PID 1952 wrote to memory of 2552	1952	rundll32.exe	28
PID 1952 wrote to memory of 2552	1952	rundll32.exe	28
PID 1952 wrote to memory of 2552	1952	rundll32.exe	28
PID 1952 wrote to memory of 2552	1952	rundll32.exe	28
PID 1952 wrote to memory of 2552	1952	rundll32.exe	28
PID 2552 wrote to memory of 2456	2552	rundll32.exe	29
PID 2552 wrote to memory of 2456	2552	rundll32.exe	29
PID 2552 wrote to memory of 2456	2552	rundll32.exe	29
PID 2552 wrote to memory of 2456	2552	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa892d6eed0066286bb93df739ac9a3e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa892d6eed0066286bb93df739ac9a3e_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 244
    3⤵
    - Program crash
    PID:2456