852271367ca50ba41d40470ca71bba5c9932381861a964acce0d3378257efdeb

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 07:35

Target

785eccfcac902d9ab7d6bc1c117774af_JaffaCakes118.dll
Size

269KB
MD5

785eccfcac902d9ab7d6bc1c117774af
SHA1

ef7628112c0651b0a887cda5a42df91de3a16ce0
SHA256

852271367ca50ba41d40470ca71bba5c9932381861a964acce0d3378257efdeb
SHA512

2bb44b9fc8a5fdd4411f5646752b617a29a18d22bbd6aeaa5520a2b81cd3899fae9be3a4228a51c6163b6b27f68438145dd7b21341950ffbc8c87c8910713289
SSDEEP

6144:8prxxg76/T1VAwODO+ggme9O/CGv9ROtei5zOOA:Krxxg76/T14m2M94A

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1988	1872	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1872	2236	rundll32.exe	28
PID 2236 wrote to memory of 1872	2236	rundll32.exe	28
PID 2236 wrote to memory of 1872	2236	rundll32.exe	28
PID 2236 wrote to memory of 1872	2236	rundll32.exe	28
PID 2236 wrote to memory of 1872	2236	rundll32.exe	28
PID 2236 wrote to memory of 1872	2236	rundll32.exe	28
PID 2236 wrote to memory of 1872	2236	rundll32.exe	28
PID 1872 wrote to memory of 1988	1872	rundll32.exe	29
PID 1872 wrote to memory of 1988	1872	rundll32.exe	29
PID 1872 wrote to memory of 1988	1872	rundll32.exe	29
PID 1872 wrote to memory of 1988	1872	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\785eccfcac902d9ab7d6bc1c117774af_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\785eccfcac902d9ab7d6bc1c117774af_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 224
    3⤵
    - Program crash
    PID:1988