5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 12:26

Target

6e843ef4856336fe3ef4ed27a4c792b1_JaffaCakes118.dll
Size

199KB
MD5

6e843ef4856336fe3ef4ed27a4c792b1
SHA1

1875db18a7c01ec011b1fe2394dfc49ed8a53956
SHA256

5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362
SHA512

8215c089f60f80b174530ebcc62bed7a9c01d086d429791fa2dd3a95cd034f7ece097c7d6824becfd00b0d0587bb0a5249fb644652ef3b6a78469c322bdb0281
SSDEEP

3072:HNEfMCK7JqusgLiKG5TnN7FgkQB7R80kUzRe5f1:SfM5dS/JBN7jiR80Vw

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2372 2376 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2372	2376	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1044 wrote to memory of 2376	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2376	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2376	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2376	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2376	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2376	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2376	1044	rundll32.exe	rundll32.exe
PID 2376 wrote to memory of 2372	2376	rundll32.exe	WerFault.exe
PID 2376 wrote to memory of 2372	2376	rundll32.exe	WerFault.exe
PID 2376 wrote to memory of 2372	2376	rundll32.exe	WerFault.exe
PID 2376 wrote to memory of 2372	2376	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e843ef4856336fe3ef4ed27a4c792b1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e843ef4856336fe3ef4ed27a4c792b1_JaffaCakes118.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 240
3⤵
- Program crash
PID:2372