74fd242a40bd4c2354f700eb78357a56aae00cb9a48ce875ebff5faf2bdabbdc

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 01:31

Target

0bce9be309b0af08d6b28d1b4f99e572_JaffaCakes118.dll
Size

169KB
MD5

0bce9be309b0af08d6b28d1b4f99e572
SHA1

6c5aee693103544bb2dbfce80cdb5ea2c3ea09c6
SHA256

74fd242a40bd4c2354f700eb78357a56aae00cb9a48ce875ebff5faf2bdabbdc
SHA512

7ccd0efc5b5e58193e2b89b0ecde20c8336393fada633d25c74f6dde6f5a87b6a81649a9db1ba0692f41eacb11fbd7b95e134d0eb0c0e7725635d8a0a5dfa6d1
SSDEEP

3072:vuhE6zRklwBGwRA72tVDtv7gPFB0rjmqyVDmJFd+cYqMTrLS7:vuh+wB+72tptvUv0rKqyJ5xG7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2888	2092	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2092	3008	rundll32.exe	28
PID 3008 wrote to memory of 2092	3008	rundll32.exe	28
PID 3008 wrote to memory of 2092	3008	rundll32.exe	28
PID 3008 wrote to memory of 2092	3008	rundll32.exe	28
PID 3008 wrote to memory of 2092	3008	rundll32.exe	28
PID 3008 wrote to memory of 2092	3008	rundll32.exe	28
PID 3008 wrote to memory of 2092	3008	rundll32.exe	28
PID 2092 wrote to memory of 2888	2092	rundll32.exe	29
PID 2092 wrote to memory of 2888	2092	rundll32.exe	29
PID 2092 wrote to memory of 2888	2092	rundll32.exe	29
PID 2092 wrote to memory of 2888	2092	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bce9be309b0af08d6b28d1b4f99e572_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bce9be309b0af08d6b28d1b4f99e572_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 260
    3⤵
    - Program crash
    PID:2888