59c35d6faf41de594bd684d471a285f023ebd2a5760d6be4365ce7515f4d77a4

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 14:17

Target

06bda8f830cc3ec531961c3c852cf0d8_JaffaCakes118.dll
Size

204KB
MD5

06bda8f830cc3ec531961c3c852cf0d8
SHA1

4516dc70077bf223ba45f96233d413eadc283759
SHA256

59c35d6faf41de594bd684d471a285f023ebd2a5760d6be4365ce7515f4d77a4
SHA512

aaa675f8c170161c17ddaca6ff0dcbe815966ffd5bd542d32b928fdd058fc27479ee4aae7acd93a97a055d52cc0d14fac02d937c729566e4c72484bd85bb0230
SSDEEP

3072:Y9mqZ5xn7NWydCdyDIjxrCxDTqJ85bG7LNYaVZ4vSccGRbTm/0qHkcO5VnAA1uCp:mBR48TIvNYM4uCj2I

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2984	1896	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1896	2392	rundll32.exe	28
PID 2392 wrote to memory of 1896	2392	rundll32.exe	28
PID 2392 wrote to memory of 1896	2392	rundll32.exe	28
PID 2392 wrote to memory of 1896	2392	rundll32.exe	28
PID 2392 wrote to memory of 1896	2392	rundll32.exe	28
PID 2392 wrote to memory of 1896	2392	rundll32.exe	28
PID 2392 wrote to memory of 1896	2392	rundll32.exe	28
PID 1896 wrote to memory of 2984	1896	rundll32.exe	29
PID 1896 wrote to memory of 2984	1896	rundll32.exe	29
PID 1896 wrote to memory of 2984	1896	rundll32.exe	29
PID 1896 wrote to memory of 2984	1896	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06bda8f830cc3ec531961c3c852cf0d8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06bda8f830cc3ec531961c3c852cf0d8_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 256
    3⤵
    - Program crash
    PID:2984