b8813d15f9a843a555dd3fa1c83eb0965807946d61b5eae9b5b285f7d56c9ba8

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 11:38

Target

1290200e40ae16a493b89ccf4173e81e_JaffaCakes118.dll
Size

11KB
MD5

1290200e40ae16a493b89ccf4173e81e
SHA1

bcbc4e9515a0add11aa8cc2554545436a2ee5884
SHA256

b8813d15f9a843a555dd3fa1c83eb0965807946d61b5eae9b5b285f7d56c9ba8
SHA512

a5b056379535285731cbe59b1fd749c0cfcadcacd2a8c8337795cc6cc313fc6dd0e8cf18dd9a2ed9ef39674f9a3349274c4734f67bde8ce2300dd6cc71955511
SSDEEP

192:5N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Vx:GJoiO8V2upW7vQjS/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1228	2096	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2096	2300	rundll32.exe	28
PID 2300 wrote to memory of 2096	2300	rundll32.exe	28
PID 2300 wrote to memory of 2096	2300	rundll32.exe	28
PID 2300 wrote to memory of 2096	2300	rundll32.exe	28
PID 2300 wrote to memory of 2096	2300	rundll32.exe	28
PID 2300 wrote to memory of 2096	2300	rundll32.exe	28
PID 2300 wrote to memory of 2096	2300	rundll32.exe	28
PID 2096 wrote to memory of 1228	2096	rundll32.exe	29
PID 2096 wrote to memory of 1228	2096	rundll32.exe	29
PID 2096 wrote to memory of 1228	2096	rundll32.exe	29
PID 2096 wrote to memory of 1228	2096	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1290200e40ae16a493b89ccf4173e81e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1290200e40ae16a493b89ccf4173e81e_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 220
    3⤵
    - Program crash
    PID:1228