0bfd063cc1607ad11fdf9b12b30bdf3e2e105842b25c89007225314755c15cff

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 04:01

Target

2ae7c94c910b011a6eefa91e6b3c1183_JaffaCakes118.dll
Size

76KB
MD5

2ae7c94c910b011a6eefa91e6b3c1183
SHA1

9b4aa7a7980cec29a8cfbc56dbca80ede0a09cb6
SHA256

0bfd063cc1607ad11fdf9b12b30bdf3e2e105842b25c89007225314755c15cff
SHA512

fee894c79079beb9ac4350fb1879759ff564e5b7d355872cf9d6a73cec50828577c1606414461baecf91ce17f3bf7a12a4ce4ce1c8c9227490aae8ce623ae2df
SSDEEP

1536:kEDuON9p7H+GDOemZ8F6M8/QP+s5IOeFnToIf1OxczY6SuOD6:k+5eGuv/QmsTetTBfEuzY6SuOD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2152	2140	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2140	2136	rundll32.exe	29
PID 2136 wrote to memory of 2140	2136	rundll32.exe	29
PID 2136 wrote to memory of 2140	2136	rundll32.exe	29
PID 2136 wrote to memory of 2140	2136	rundll32.exe	29
PID 2136 wrote to memory of 2140	2136	rundll32.exe	29
PID 2136 wrote to memory of 2140	2136	rundll32.exe	29
PID 2136 wrote to memory of 2140	2136	rundll32.exe	29
PID 2140 wrote to memory of 2152	2140	rundll32.exe	30
PID 2140 wrote to memory of 2152	2140	rundll32.exe	30
PID 2140 wrote to memory of 2152	2140	rundll32.exe	30
PID 2140 wrote to memory of 2152	2140	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ae7c94c910b011a6eefa91e6b3c1183_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ae7c94c910b011a6eefa91e6b3c1183_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 260
    3⤵
    - Program crash
    PID:2152