d1f8607f8cd2021289cba87bb4f8038996914114c540e22405b63fb932d710a3

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 17:05

Target

4c2444a444c3ebc60029644fe536542f_JaffaCakes118.dll
Size

2.8MB
MD5

4c2444a444c3ebc60029644fe536542f
SHA1

44c4d50f02189fa35643e303eae68a42c36b7b93
SHA256

d1f8607f8cd2021289cba87bb4f8038996914114c540e22405b63fb932d710a3
SHA512

3fa8884c60285b1b11c358d24780907a81b1670b53159defbd2597f8c42b51bbdb6d4c9f32a0d892d47dac34c815c31df94ef6a4bbb9a11b5d3182666175642e
SSDEEP

49152:Mne9zZoDyY7y6e9Kd/MDzTVh0f6pG9vMopi8Ks5afnRWEVihoHoKiI9cX:LRZoDyee9KKVa6pG9EN8Ks5af0Ewi3M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2748	2888	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 2888	1500	rundll32.exe	28
PID 1500 wrote to memory of 2888	1500	rundll32.exe	28
PID 1500 wrote to memory of 2888	1500	rundll32.exe	28
PID 1500 wrote to memory of 2888	1500	rundll32.exe	28
PID 1500 wrote to memory of 2888	1500	rundll32.exe	28
PID 1500 wrote to memory of 2888	1500	rundll32.exe	28
PID 1500 wrote to memory of 2888	1500	rundll32.exe	28
PID 2888 wrote to memory of 2748	2888	rundll32.exe	29
PID 2888 wrote to memory of 2748	2888	rundll32.exe	29
PID 2888 wrote to memory of 2748	2888	rundll32.exe	29
PID 2888 wrote to memory of 2748	2888	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c2444a444c3ebc60029644fe536542f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c2444a444c3ebc60029644fe536542f_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 264
    3⤵
    - Program crash
    PID:2748