1882bd7f6503c73955949b6c09980ac45b2c5fcfd945c3545572a871f15da7d4

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 07:37

Target

27c0b31dda54980b91553c12d451df90_JaffaCakes118.dll
Size

96KB
MD5

27c0b31dda54980b91553c12d451df90
SHA1

6481c58434f3f5520596ee1ad135d1cf36fffb4e
SHA256

1882bd7f6503c73955949b6c09980ac45b2c5fcfd945c3545572a871f15da7d4
SHA512

bcaf2fccee5e06558beaf880840a0e9e32d0b70bdc3ae65d83aea05747f5c2e4ff6b99cf87317e7b374339a6be004d4cd86f0506db96fa6a529ea6ff5a10cbf6
SSDEEP

1536:nmEgDV9y5GXvkGwd5shTcgD/XLG99P5ju7/a9Z9+C:nmEgDzB8bdUcgz74PFuDa9ZYC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2424	2392	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2392	2548	rundll32.exe	30
PID 2548 wrote to memory of 2392	2548	rundll32.exe	30
PID 2548 wrote to memory of 2392	2548	rundll32.exe	30
PID 2548 wrote to memory of 2392	2548	rundll32.exe	30
PID 2548 wrote to memory of 2392	2548	rundll32.exe	30
PID 2548 wrote to memory of 2392	2548	rundll32.exe	30
PID 2548 wrote to memory of 2392	2548	rundll32.exe	30
PID 2392 wrote to memory of 2424	2392	rundll32.exe	31
PID 2392 wrote to memory of 2424	2392	rundll32.exe	31
PID 2392 wrote to memory of 2424	2392	rundll32.exe	31
PID 2392 wrote to memory of 2424	2392	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27c0b31dda54980b91553c12d451df90_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27c0b31dda54980b91553c12d451df90_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 252
    3⤵
    - Program crash
    PID:2424