c8ad61a8d8750e6bbda5b43733e9a0f70ca9df0d8d4df904f72706a4cf9ea154

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 12:40

Target

9e35ecdc339aef986de27c102a35ca0f_JaffaCakes118.dll
Size

205KB
MD5

9e35ecdc339aef986de27c102a35ca0f
SHA1

ab7af262fd791a84c07c972772cdf88dbf132874
SHA256

c8ad61a8d8750e6bbda5b43733e9a0f70ca9df0d8d4df904f72706a4cf9ea154
SHA512

1990f6ac68f94d0ae85419d4343fa2239e5753a99082eea0285194bfc3afa4f857da6fec62b65497c7ac1296253a3a8cd1824fc2b259e3625de5ce030aec3af6
SSDEEP

3072:5ZrNm0q1UmGTUVjsY9vsVfYLVthu1aYYp1V92R1n6/0IU1Dlw35p6B:5qV+KDCVfenh+Qfg2/0VW

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2892 3040 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2892	3040	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3028 wrote to memory of 3040	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 3040	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 3040	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 3040	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 3040	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 3040	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 3040	3028	rundll32.exe	rundll32.exe
PID 3040 wrote to memory of 2892	3040	rundll32.exe	WerFault.exe
PID 3040 wrote to memory of 2892	3040	rundll32.exe	WerFault.exe
PID 3040 wrote to memory of 2892	3040	rundll32.exe	WerFault.exe
PID 3040 wrote to memory of 2892	3040	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e35ecdc339aef986de27c102a35ca0f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e35ecdc339aef986de27c102a35ca0f_JaffaCakes118.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 240
3⤵
- Program crash
PID:2892