fa7a17fc23fb97f9c81d30532069c18f64aeb53de4a90feb251445d1e0b75a4d

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 09:52

Target

2be3481523392be25417d28691deb227_JaffaCakes118.dll
Size

17KB
MD5

2be3481523392be25417d28691deb227
SHA1

cfbe6a55e9f3e07e1d01b90a7461f7e0623cb197
SHA256

fa7a17fc23fb97f9c81d30532069c18f64aeb53de4a90feb251445d1e0b75a4d
SHA512

51f9cbac984c8af6c09a788b7e95652de57af07bf49b5a5fe824b208d6fd03f3243276e030aa9a8e33fd992cbd9f7d89636778eaab2b4cede2176bf08902cedb
SSDEEP

192:m7mFbyBrGv9OQMJcSQNzlPHO3aEZ27x5QhuBBQ6PRQkocOYPv9mCG:myF2Mv8QIufO3ybQhuBBQARQkjOYPv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3024	2864	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2864	2840	rundll32.exe	30
PID 2840 wrote to memory of 2864	2840	rundll32.exe	30
PID 2840 wrote to memory of 2864	2840	rundll32.exe	30
PID 2840 wrote to memory of 2864	2840	rundll32.exe	30
PID 2840 wrote to memory of 2864	2840	rundll32.exe	30
PID 2840 wrote to memory of 2864	2840	rundll32.exe	30
PID 2840 wrote to memory of 2864	2840	rundll32.exe	30
PID 2864 wrote to memory of 3024	2864	rundll32.exe	31
PID 2864 wrote to memory of 3024	2864	rundll32.exe	31
PID 2864 wrote to memory of 3024	2864	rundll32.exe	31
PID 2864 wrote to memory of 3024	2864	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2be3481523392be25417d28691deb227_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2be3481523392be25417d28691deb227_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 224
    3⤵
    - Program crash
    PID:3024