80cca5e32407e469db092d6e13da63567a38c00341997350e882cdd13936920d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 22:05

Target

0adca909ad053b9435132c81a5cf3fb5_JaffaCakes118.dll
Size

3KB
MD5

0adca909ad053b9435132c81a5cf3fb5
SHA1

c365fbd99ea5e88b300e67df557263603e551b07
SHA256

80cca5e32407e469db092d6e13da63567a38c00341997350e882cdd13936920d
SHA512

999936b402507242d960b1ca3907923fa34a62283980277f1c238ec323e57d0ac41f9c96a4f97df410d0255489e24782de061fa7a8b2aab00de8ded8cf86502d

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2412	2956	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2956	2944	rundll32.exe	28
PID 2944 wrote to memory of 2956	2944	rundll32.exe	28
PID 2944 wrote to memory of 2956	2944	rundll32.exe	28
PID 2944 wrote to memory of 2956	2944	rundll32.exe	28
PID 2944 wrote to memory of 2956	2944	rundll32.exe	28
PID 2944 wrote to memory of 2956	2944	rundll32.exe	28
PID 2944 wrote to memory of 2956	2944	rundll32.exe	28
PID 2956 wrote to memory of 2412	2956	rundll32.exe	29
PID 2956 wrote to memory of 2412	2956	rundll32.exe	29
PID 2956 wrote to memory of 2412	2956	rundll32.exe	29
PID 2956 wrote to memory of 2412	2956	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0adca909ad053b9435132c81a5cf3fb5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0adca909ad053b9435132c81a5cf3fb5_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 288
    3⤵
    - Program crash
    PID:2412