ec0bfe2a04c4608b204e716751ae3e64fbb928caf937c3f57c76a68459d2cd8c

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 07:05

Target

1fd2d4a075163cd6dfae8459a5b31a25_JaffaCakes118.dll
Size

2.8MB
MD5

1fd2d4a075163cd6dfae8459a5b31a25
SHA1

eedf52767022950ee6d6ed61e283bd4a1cabfbc2
SHA256

ec0bfe2a04c4608b204e716751ae3e64fbb928caf937c3f57c76a68459d2cd8c
SHA512

88ddee5cfb2adc8543d3e72ec18b313d85546adb7b942be26a38cc65a0bb2fa08a7db903227b4614cb7ab75d4ea9459e480c0da7319a5fa19d8bf18381838366
SSDEEP

49152:DnI9zZoDyY7y6e9Kd6eDjHKQJY2MG9vDpdyMKoUBY2i/WVYamf:sRZoDyee9Kr5W2MG97eMKoUBYrWmR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3040	3032	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 3032	2424	rundll32.exe	28
PID 2424 wrote to memory of 3032	2424	rundll32.exe	28
PID 2424 wrote to memory of 3032	2424	rundll32.exe	28
PID 2424 wrote to memory of 3032	2424	rundll32.exe	28
PID 2424 wrote to memory of 3032	2424	rundll32.exe	28
PID 2424 wrote to memory of 3032	2424	rundll32.exe	28
PID 2424 wrote to memory of 3032	2424	rundll32.exe	28
PID 3032 wrote to memory of 3040	3032	rundll32.exe	29
PID 3032 wrote to memory of 3040	3032	rundll32.exe	29
PID 3032 wrote to memory of 3040	3032	rundll32.exe	29
PID 3032 wrote to memory of 3040	3032	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1fd2d4a075163cd6dfae8459a5b31a25_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1fd2d4a075163cd6dfae8459a5b31a25_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 260
    3⤵
    - Program crash
    PID:3040