90cffbd0c756e7fc4b8aac4cbe0fcb92790f3821c6ae8a25e58ae92eccaf37ec

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 15:41

Target

2ce2e4e872ad777a1a6d3dfeba2aa9ac_JaffaCakes118.dll
Size

84KB
MD5

2ce2e4e872ad777a1a6d3dfeba2aa9ac
SHA1

bfcac97e6fe49a54e4a7fae6c451a27796aae60d
SHA256

90cffbd0c756e7fc4b8aac4cbe0fcb92790f3821c6ae8a25e58ae92eccaf37ec
SHA512

cd0193d7b2f7cce19f058fb52513eb2b81e151986982ebc6bed1e1a79e93e40c2c06f9a8dad0cbd2da02e01bbce544005110cd73d4a888678c73c14c334dec96
SSDEEP

1536:p8OIDkKTd4un82fqwjINDfwS/qxG08PNmY:YDkK6un82fqwMNjwGmN8PNmY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2804	2748	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2748	2708	rundll32.exe	31
PID 2708 wrote to memory of 2748	2708	rundll32.exe	31
PID 2708 wrote to memory of 2748	2708	rundll32.exe	31
PID 2708 wrote to memory of 2748	2708	rundll32.exe	31
PID 2708 wrote to memory of 2748	2708	rundll32.exe	31
PID 2708 wrote to memory of 2748	2708	rundll32.exe	31
PID 2708 wrote to memory of 2748	2708	rundll32.exe	31
PID 2748 wrote to memory of 2804	2748	rundll32.exe	32
PID 2748 wrote to memory of 2804	2748	rundll32.exe	32
PID 2748 wrote to memory of 2804	2748	rundll32.exe	32
PID 2748 wrote to memory of 2804	2748	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ce2e4e872ad777a1a6d3dfeba2aa9ac_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ce2e4e872ad777a1a6d3dfeba2aa9ac_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 236
    3⤵
    - Program crash
    PID:2804