11db4e1bd1226d8a855e69ff67ed813cd89bff3d0b3bf37eccf329775a0f3ad8

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 12:43

Target

2c63b21ba4bb08cefeb4fed1313832b5_JaffaCakes118.dll
Size

4KB
MD5

2c63b21ba4bb08cefeb4fed1313832b5
SHA1

bf1134fce68f539348b6ba76b3d93767025d6682
SHA256

11db4e1bd1226d8a855e69ff67ed813cd89bff3d0b3bf37eccf329775a0f3ad8
SHA512

09f2f6c50e0dfdc727902f6561952cac0d91360cee16b2b62f8f55d2ce1b9ba348430a21761e17218ae2d2973b9e192c5fec7928c3af886e53abdcdd6f36b2fb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2996	2992	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2992	1336	rundll32.exe	31
PID 1336 wrote to memory of 2992	1336	rundll32.exe	31
PID 1336 wrote to memory of 2992	1336	rundll32.exe	31
PID 1336 wrote to memory of 2992	1336	rundll32.exe	31
PID 1336 wrote to memory of 2992	1336	rundll32.exe	31
PID 1336 wrote to memory of 2992	1336	rundll32.exe	31
PID 1336 wrote to memory of 2992	1336	rundll32.exe	31
PID 2992 wrote to memory of 2996	2992	rundll32.exe	32
PID 2992 wrote to memory of 2996	2992	rundll32.exe	32
PID 2992 wrote to memory of 2996	2992	rundll32.exe	32
PID 2992 wrote to memory of 2996	2992	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c63b21ba4bb08cefeb4fed1313832b5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c63b21ba4bb08cefeb4fed1313832b5_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 224
    3⤵
    - Program crash
    PID:2996