5e42abbb76d60af63fa4dd8a528f6f6bb925cbf1dc121a5133a01744cc91696c

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 08:40

Target

1aa38705192454b0258ac88daae7c2ed_JaffaCakes118.dll
Size

76KB
MD5

1aa38705192454b0258ac88daae7c2ed
SHA1

225dfc1be13c9d8e07defe0db83d117b470d0935
SHA256

5e42abbb76d60af63fa4dd8a528f6f6bb925cbf1dc121a5133a01744cc91696c
SHA512

9c055af50b3503b8fea8e755a27923f26b4a46ac1b1a9347ee86a2448a5040fddf78e178a51173f499a2587d304ffcaaef89050f1c3e782d6251e83f1f86c315
SSDEEP

768:Yhr/iEx7lLKF285qUNe/M0rxAqlbmd51S+yWBCFNF:+/iIEFVoHrOqo1S4BCP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1108	2556	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2556	2440	rundll32.exe	28
PID 2440 wrote to memory of 2556	2440	rundll32.exe	28
PID 2440 wrote to memory of 2556	2440	rundll32.exe	28
PID 2440 wrote to memory of 2556	2440	rundll32.exe	28
PID 2440 wrote to memory of 2556	2440	rundll32.exe	28
PID 2440 wrote to memory of 2556	2440	rundll32.exe	28
PID 2440 wrote to memory of 2556	2440	rundll32.exe	28
PID 2556 wrote to memory of 1108	2556	rundll32.exe	29
PID 2556 wrote to memory of 1108	2556	rundll32.exe	29
PID 2556 wrote to memory of 1108	2556	rundll32.exe	29
PID 2556 wrote to memory of 1108	2556	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1aa38705192454b0258ac88daae7c2ed_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1aa38705192454b0258ac88daae7c2ed_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 228
    3⤵
    - Program crash
    PID:1108