f12189029882e631f3cd1e55b1492aea636d610cb82d2b83bac8852df828bd7d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 01:24

Target

01b07cb4295ee41ebdca46789e762e35_JaffaCakes118.dll
Size

40KB
MD5

01b07cb4295ee41ebdca46789e762e35
SHA1

70f71cc3f1d2a030adbf316cb1e6c568ae1956cd
SHA256

f12189029882e631f3cd1e55b1492aea636d610cb82d2b83bac8852df828bd7d
SHA512

b720a3614d1006b3cd3d3a3708884dc9dd4436592d2043a8e47448d0de03af374c1a78872d503f5ca1d48c87d3f7b1b2b04474edfa8ccdbcdaf3e54b9da40a74
SSDEEP

384:rcPTLFwVtTr45Raf3/iDYABg3/cte5i5RBR0769m5hxGXI3h+dvGIuIINQuac0M+:sypoi3KDo3/Iec79exGKA4ImNQuF9i

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2076	2304	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2304	2228	rundll32.exe	28
PID 2228 wrote to memory of 2304	2228	rundll32.exe	28
PID 2228 wrote to memory of 2304	2228	rundll32.exe	28
PID 2228 wrote to memory of 2304	2228	rundll32.exe	28
PID 2228 wrote to memory of 2304	2228	rundll32.exe	28
PID 2228 wrote to memory of 2304	2228	rundll32.exe	28
PID 2228 wrote to memory of 2304	2228	rundll32.exe	28
PID 2304 wrote to memory of 2076	2304	rundll32.exe	29
PID 2304 wrote to memory of 2076	2304	rundll32.exe	29
PID 2304 wrote to memory of 2076	2304	rundll32.exe	29
PID 2304 wrote to memory of 2076	2304	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01b07cb4295ee41ebdca46789e762e35_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01b07cb4295ee41ebdca46789e762e35_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 232
    3⤵
    - Program crash
    PID:2076