8648eb7460b436cf3ca07088e3563c940262a9ac7e9589ff2e37a8c5a5ff84fd

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 13:53

Target

5f6c2092289032b7a248bd83fd5fe504_JaffaCakes118.dll
Size

202KB
MD5

5f6c2092289032b7a248bd83fd5fe504
SHA1

fe1d507df5c79f2a4b359d19ff5387d742115edb
SHA256

8648eb7460b436cf3ca07088e3563c940262a9ac7e9589ff2e37a8c5a5ff84fd
SHA512

871ae96d232df4eb7afcc7001559ea012edb3464ed65dbd0a67184eae062b74b2d30b2a0292c42281fc091bb168957a1d7350ccb401e80919ac91eb7c97b39be
SSDEEP

3072:Pjh9N4a1j712h9Td2+1lxvTeZna8xUhUbT15T0:PjdFKdoSxvixTxUAg

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2912 2600 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2912	2600	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2884 wrote to memory of 2600	2884	rundll32.exe	rundll32.exe
PID 2884 wrote to memory of 2600	2884	rundll32.exe	rundll32.exe
PID 2884 wrote to memory of 2600	2884	rundll32.exe	rundll32.exe
PID 2884 wrote to memory of 2600	2884	rundll32.exe	rundll32.exe
PID 2884 wrote to memory of 2600	2884	rundll32.exe	rundll32.exe
PID 2884 wrote to memory of 2600	2884	rundll32.exe	rundll32.exe
PID 2884 wrote to memory of 2600	2884	rundll32.exe	rundll32.exe
PID 2600 wrote to memory of 2912	2600	rundll32.exe	WerFault.exe
PID 2600 wrote to memory of 2912	2600	rundll32.exe	WerFault.exe
PID 2600 wrote to memory of 2912	2600	rundll32.exe	WerFault.exe
PID 2600 wrote to memory of 2912	2600	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f6c2092289032b7a248bd83fd5fe504_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f6c2092289032b7a248bd83fd5fe504_JaffaCakes118.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 244
3⤵
- Program crash
PID:2912