356694f039d1d0c398dabff0b00ae1d5fa83c0639e27cb94d262ab88ff7c6687

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 20:37

Target

0f725cfbc277371847a96c0a84322b67_JaffaCakes118.dll
Size

78KB
MD5

0f725cfbc277371847a96c0a84322b67
SHA1

851c527eab572a0377516978f2f8d4b4b925785f
SHA256

356694f039d1d0c398dabff0b00ae1d5fa83c0639e27cb94d262ab88ff7c6687
SHA512

e0d943032f1298bfbda3a77e0a430954574bac062aabaf2dbe2064fc11c0652a5a688abb3f192cfecf62346bcd857d1f1f668cf5955fc1daf59bdc7141e3fd63
SSDEEP

1536:IAQigd0xSbnSwCnv10dbaOBSlMdR15UtM:DQJ+wCNIaOMlMdR15X

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2404	2264	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2264	2480	rundll32.exe	28
PID 2480 wrote to memory of 2264	2480	rundll32.exe	28
PID 2480 wrote to memory of 2264	2480	rundll32.exe	28
PID 2480 wrote to memory of 2264	2480	rundll32.exe	28
PID 2480 wrote to memory of 2264	2480	rundll32.exe	28
PID 2480 wrote to memory of 2264	2480	rundll32.exe	28
PID 2480 wrote to memory of 2264	2480	rundll32.exe	28
PID 2264 wrote to memory of 2404	2264	rundll32.exe	29
PID 2264 wrote to memory of 2404	2264	rundll32.exe	29
PID 2264 wrote to memory of 2404	2264	rundll32.exe	29
PID 2264 wrote to memory of 2404	2264	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f725cfbc277371847a96c0a84322b67_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f725cfbc277371847a96c0a84322b67_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 232
    3⤵
    - Program crash
    PID:2404