26b53aeea08843d7b1a1ab9d14ee3a51ca5bde7aa8b4dc6a52287d23abf9f1cc

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 00:47

Target

2a64738a123068e5b2f73366efde6121_JaffaCakes118.dll
Size

72KB
MD5

2a64738a123068e5b2f73366efde6121
SHA1

023f7ecdf0ac779ae903a119b28105fdd3d838f4
SHA256

26b53aeea08843d7b1a1ab9d14ee3a51ca5bde7aa8b4dc6a52287d23abf9f1cc
SHA512

88f2989595277c5843934fca8b523ecb5f52772c04d8617ed54f373734660f245a906bf8fb62a347ff7fa05378a4af448ba6b16dc55d28ff8a477806cbcd0c29
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuP:C5UOq0ukgOK2l7aFQP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2876	2224	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2224	1984	rundll32.exe	30
PID 1984 wrote to memory of 2224	1984	rundll32.exe	30
PID 1984 wrote to memory of 2224	1984	rundll32.exe	30
PID 1984 wrote to memory of 2224	1984	rundll32.exe	30
PID 1984 wrote to memory of 2224	1984	rundll32.exe	30
PID 1984 wrote to memory of 2224	1984	rundll32.exe	30
PID 1984 wrote to memory of 2224	1984	rundll32.exe	30
PID 2224 wrote to memory of 2876	2224	rundll32.exe	31
PID 2224 wrote to memory of 2876	2224	rundll32.exe	31
PID 2224 wrote to memory of 2876	2224	rundll32.exe	31
PID 2224 wrote to memory of 2876	2224	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a64738a123068e5b2f73366efde6121_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a64738a123068e5b2f73366efde6121_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 224
    3⤵
    - Program crash
    PID:2876