87c27447c4975a05008addc045573aeb7068ffa42037db332d780dcf9b91d199

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 14:13

Target

fa799ff90bb3b1f3d3f8c7333292db4b_JaffaCakes118.dll
Size

18KB
MD5

fa799ff90bb3b1f3d3f8c7333292db4b
SHA1

006d1f6d4d34193d4e75e8e5a615b3844b22f69a
SHA256

87c27447c4975a05008addc045573aeb7068ffa42037db332d780dcf9b91d199
SHA512

cbe5aff77642b709232b4e480bbb5409481fbc86b85e0484382658650e46e9e703439617afdc0edbef6c1a4ff75a54d854b89a9cb221f5e5ebf8cffd785f4d7f
SSDEEP

384:/VxhxrLEpP9o12/zVbKEKy62r6kht5eRc/5dFxLdWRPvh:txbwJ7hKs5+6t5eRc/5dLLa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1260	2760	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 2760	1096	rundll32.exe	28
PID 1096 wrote to memory of 2760	1096	rundll32.exe	28
PID 1096 wrote to memory of 2760	1096	rundll32.exe	28
PID 1096 wrote to memory of 2760	1096	rundll32.exe	28
PID 1096 wrote to memory of 2760	1096	rundll32.exe	28
PID 1096 wrote to memory of 2760	1096	rundll32.exe	28
PID 1096 wrote to memory of 2760	1096	rundll32.exe	28
PID 2760 wrote to memory of 1260	2760	rundll32.exe	29
PID 2760 wrote to memory of 1260	2760	rundll32.exe	29
PID 2760 wrote to memory of 1260	2760	rundll32.exe	29
PID 2760 wrote to memory of 1260	2760	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa799ff90bb3b1f3d3f8c7333292db4b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa799ff90bb3b1f3d3f8c7333292db4b_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 244
    3⤵
    - Program crash
    PID:1260