9dcca05cd75062683260b23db6f841c5bb4835e5a68b5e5ce3958f2064e7fd5b

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 14:18

Target

2cabc640a459b7917745b2a71949635a_JaffaCakes118.dll
Size

148KB
MD5

2cabc640a459b7917745b2a71949635a
SHA1

d7928abadc606d0e23ded7e908d002c9bfb22f70
SHA256

9dcca05cd75062683260b23db6f841c5bb4835e5a68b5e5ce3958f2064e7fd5b
SHA512

3aaa4256fb1cec0f317ae5f8af479b795321a101532a264f895ca5bbd15079c9c1a12e007ad22dacc84b65c36ead4674c66a1d7bb97bc1755247e187ff37246f
SSDEEP

3072:OG9v4j6Z/Wg/5y14wGYZ2WRDiPS3TBft8nIiHtql:OgvwWH/g1L7hiPS3TBl8nIiHtq

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rundll32.exe.txt	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3020	2956	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2956	2220	rundll32.exe	30
PID 2220 wrote to memory of 2956	2220	rundll32.exe	30
PID 2220 wrote to memory of 2956	2220	rundll32.exe	30
PID 2220 wrote to memory of 2956	2220	rundll32.exe	30
PID 2220 wrote to memory of 2956	2220	rundll32.exe	30
PID 2220 wrote to memory of 2956	2220	rundll32.exe	30
PID 2220 wrote to memory of 2956	2220	rundll32.exe	30
PID 2956 wrote to memory of 3020	2956	rundll32.exe	31
PID 2956 wrote to memory of 3020	2956	rundll32.exe	31
PID 2956 wrote to memory of 3020	2956	rundll32.exe	31
PID 2956 wrote to memory of 3020	2956	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cabc640a459b7917745b2a71949635a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cabc640a459b7917745b2a71949635a_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 252
    3⤵
    - Program crash
    PID:3020