4fa1cc8ffbdeb0e3437b971e04d296b508ccac478abbf65980b854e093c5b6a2

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 23:04

Target

29873857842c500241b69bc371f23067_JaffaCakes118.dll
Size

44KB
MD5

29873857842c500241b69bc371f23067
SHA1

7f6db4b573708f7871a16172cd57f78002abff20
SHA256

4fa1cc8ffbdeb0e3437b971e04d296b508ccac478abbf65980b854e093c5b6a2
SHA512

6f148709fa87371d353b70cbe24d94482d7ef57f84049294fc721f7c78d7e6462fc125115fa831696f497a7eb505a5a7bd2135203a886befb13811edf54f2e0b
SSDEEP

768:Xtdp79H1SFDE0dRx/pjwDQvg8Q+w63KDrYRwNpvA:d39VyE0njQTBe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	2160	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2160	2776	rundll32.exe	30
PID 2776 wrote to memory of 2160	2776	rundll32.exe	30
PID 2776 wrote to memory of 2160	2776	rundll32.exe	30
PID 2776 wrote to memory of 2160	2776	rundll32.exe	30
PID 2776 wrote to memory of 2160	2776	rundll32.exe	30
PID 2776 wrote to memory of 2160	2776	rundll32.exe	30
PID 2776 wrote to memory of 2160	2776	rundll32.exe	30
PID 2160 wrote to memory of 2028	2160	rundll32.exe	31
PID 2160 wrote to memory of 2028	2160	rundll32.exe	31
PID 2160 wrote to memory of 2028	2160	rundll32.exe	31
PID 2160 wrote to memory of 2028	2160	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\29873857842c500241b69bc371f23067_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\29873857842c500241b69bc371f23067_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 236
    3⤵
    - Program crash
    PID:2028