8f69df442b562e4d9bb94a5ba62d0bfa6fe25fa7119b015351a9edf7f6a9a8c0

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 06:07

Target

8d1f8d0fff66281b11574adf6c3d5a28_JaffaCakes118.dll
Size

395KB
MD5

8d1f8d0fff66281b11574adf6c3d5a28
SHA1

863a0e79f027d47e954744fb73bcfbd3c1448679
SHA256

8f69df442b562e4d9bb94a5ba62d0bfa6fe25fa7119b015351a9edf7f6a9a8c0
SHA512

458ea77718819cac0357571c16199a7415f1dd9c7a252a93aba678a45504235535053a67b1d495f03e864a64f9c23f835627443c70554c6b0d97e8e9efb3b31c
SSDEEP

12288:UbAMjI7gtjyJTP0jSu2y3a9tlBDq3kX/llh:gqDlcr2h9tlBD2kXt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2272	2076	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2076	2236	rundll32.exe	28
PID 2236 wrote to memory of 2076	2236	rundll32.exe	28
PID 2236 wrote to memory of 2076	2236	rundll32.exe	28
PID 2236 wrote to memory of 2076	2236	rundll32.exe	28
PID 2236 wrote to memory of 2076	2236	rundll32.exe	28
PID 2236 wrote to memory of 2076	2236	rundll32.exe	28
PID 2236 wrote to memory of 2076	2236	rundll32.exe	28
PID 2076 wrote to memory of 2272	2076	rundll32.exe	29
PID 2076 wrote to memory of 2272	2076	rundll32.exe	29
PID 2076 wrote to memory of 2272	2076	rundll32.exe	29
PID 2076 wrote to memory of 2272	2076	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d1f8d0fff66281b11574adf6c3d5a28_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d1f8d0fff66281b11574adf6c3d5a28_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 248
    3⤵
    - Program crash
    PID:2272