1d67178bfc085277b40d7621e5d8386ec12f82be94c29564ba4a0ae66e501695

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 04:56

Target

24b3a21d8bc8f671cead9e2b5ea65d13_JaffaCakes118.dll
Size

393KB
MD5

24b3a21d8bc8f671cead9e2b5ea65d13
SHA1

88fa46ada24e83fa7ca1677b4e40c15845169958
SHA256

1d67178bfc085277b40d7621e5d8386ec12f82be94c29564ba4a0ae66e501695
SHA512

cd97b791ea866683e6bf584fc08ee8fff2bbba492eaf5fdc306c3a748bd67f41bc5084ba5367d83204c9e342acf4b5fba5e227e76f6d0a02cfbdb668c52b6db6
SSDEEP

6144:s5VW+nK2DbcOyuzCCTA8np8SeQsajimSh6wj7lM:yyu+J7lM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2864	2016	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2016	1856	rundll32.exe	28
PID 1856 wrote to memory of 2016	1856	rundll32.exe	28
PID 1856 wrote to memory of 2016	1856	rundll32.exe	28
PID 1856 wrote to memory of 2016	1856	rundll32.exe	28
PID 1856 wrote to memory of 2016	1856	rundll32.exe	28
PID 1856 wrote to memory of 2016	1856	rundll32.exe	28
PID 1856 wrote to memory of 2016	1856	rundll32.exe	28
PID 2016 wrote to memory of 2864	2016	rundll32.exe	29
PID 2016 wrote to memory of 2864	2016	rundll32.exe	29
PID 2016 wrote to memory of 2864	2016	rundll32.exe	29
PID 2016 wrote to memory of 2864	2016	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24b3a21d8bc8f671cead9e2b5ea65d13_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24b3a21d8bc8f671cead9e2b5ea65d13_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 192
    3⤵
    - Program crash
    PID:2864