54e66a190b0967c1b1dc1fd24245fef47748033426e3603b54ee8ef2b7d3ac8d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 07:23

Target

072a771b81bdca48a5333c51a59b5784_JaffaCakes118.dll
Size

92KB
MD5

072a771b81bdca48a5333c51a59b5784
SHA1

8e11a3093f1cfeab2bd8be1b3f142173b3e9d1fe
SHA256

54e66a190b0967c1b1dc1fd24245fef47748033426e3603b54ee8ef2b7d3ac8d
SHA512

ee325fc1c8cd1cf0bf49c4d0c1977f08ee714832b76f30d16a5e1238aadcadfe7143a434f12f091359eabbc200ffb59e08c245e2e365485e073585bcd9631f74
SSDEEP

1536:+ID7mEVe+fsZr0ItmnKXH99P5ju7/a9Z9OFD:JD6+C0IkKTPFuDa9ZI9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1468	2032	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2032	1044	rundll32.exe	28
PID 1044 wrote to memory of 2032	1044	rundll32.exe	28
PID 1044 wrote to memory of 2032	1044	rundll32.exe	28
PID 1044 wrote to memory of 2032	1044	rundll32.exe	28
PID 1044 wrote to memory of 2032	1044	rundll32.exe	28
PID 1044 wrote to memory of 2032	1044	rundll32.exe	28
PID 1044 wrote to memory of 2032	1044	rundll32.exe	28
PID 2032 wrote to memory of 1468	2032	rundll32.exe	29
PID 2032 wrote to memory of 1468	2032	rundll32.exe	29
PID 2032 wrote to memory of 1468	2032	rundll32.exe	29
PID 2032 wrote to memory of 1468	2032	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\072a771b81bdca48a5333c51a59b5784_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\072a771b81bdca48a5333c51a59b5784_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 248
    3⤵
    - Program crash
    PID:1468