08dd0c2db0ce15ed4feadcf5ce01412e7eded6c7b66afa565e92d567374b0252

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 23:57

Target

23ecbbb2141c474c0bb0f061a149b46b_JaffaCakes118.dll
Size

109KB
MD5

23ecbbb2141c474c0bb0f061a149b46b
SHA1

c902e2d3e7fe3527c98a2975fbacc8218b5756c9
SHA256

08dd0c2db0ce15ed4feadcf5ce01412e7eded6c7b66afa565e92d567374b0252
SHA512

26959de0d587e78e96d3c24207f83f7fbb7d6877355e6207fd2e9520fbd8a4d1f48541d9498bb161f787f21ff9b219f109027631a24a972586125689d877d8fb
SSDEEP

1536:EpF0L5+uxcbd51Q3ELQqYcsDrfcDUnjiEliRJxVymQS7yvx9Cx:SF0Aj1QsQqY/D7cDUjZlYJxVyjS7yJAx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2240	2056	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2056	2132	rundll32.exe	28
PID 2132 wrote to memory of 2056	2132	rundll32.exe	28
PID 2132 wrote to memory of 2056	2132	rundll32.exe	28
PID 2132 wrote to memory of 2056	2132	rundll32.exe	28
PID 2132 wrote to memory of 2056	2132	rundll32.exe	28
PID 2132 wrote to memory of 2056	2132	rundll32.exe	28
PID 2132 wrote to memory of 2056	2132	rundll32.exe	28
PID 2056 wrote to memory of 2240	2056	rundll32.exe	29
PID 2056 wrote to memory of 2240	2056	rundll32.exe	29
PID 2056 wrote to memory of 2240	2056	rundll32.exe	29
PID 2056 wrote to memory of 2240	2056	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23ecbbb2141c474c0bb0f061a149b46b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23ecbbb2141c474c0bb0f061a149b46b_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 268
    3⤵
    - Program crash
    PID:2240