21c855bc185f8ab48ec8f633b02f2e3fdc337c7c8dd45d55694e98adacb2d6a3

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 18:38

Target

17162da33b46558191bf10414b9bb6e8_JaffaCakes118.dll
Size

278KB
MD5

17162da33b46558191bf10414b9bb6e8
SHA1

c8a077177a171ae3d28e61547aeb825e9e22cc13
SHA256

21c855bc185f8ab48ec8f633b02f2e3fdc337c7c8dd45d55694e98adacb2d6a3
SHA512

31d6c00934bb87028c92a6f4f9f5710b8c2364c235b5fff0529b28897ff05d43167934da120f9cc54375b9c17fc4fbc3e84daf041c58b2f161a33413c75c4740
SSDEEP

3072:sc3MVWRInKONJpbcOyALzClMTnP4BP8BdIe8SeQsajimML/:s5VW+nK2DbcOyuzCCTA8np8SeQsajims

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2144	2116	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2116	1700	rundll32.exe	29
PID 1700 wrote to memory of 2116	1700	rundll32.exe	29
PID 1700 wrote to memory of 2116	1700	rundll32.exe	29
PID 1700 wrote to memory of 2116	1700	rundll32.exe	29
PID 1700 wrote to memory of 2116	1700	rundll32.exe	29
PID 1700 wrote to memory of 2116	1700	rundll32.exe	29
PID 1700 wrote to memory of 2116	1700	rundll32.exe	29
PID 2116 wrote to memory of 2144	2116	rundll32.exe	30
PID 2116 wrote to memory of 2144	2116	rundll32.exe	30
PID 2116 wrote to memory of 2144	2116	rundll32.exe	30
PID 2116 wrote to memory of 2144	2116	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17162da33b46558191bf10414b9bb6e8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\17162da33b46558191bf10414b9bb6e8_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 192
    3⤵
    - Program crash
    PID:2144