26bcba222058739e6a290edfba8519b7e8224810f34bfb3f557cd9ed5f76bdc3

Analysis

max time kernel
16s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 19:27

Target

2d8b745e2a61588e0a79bb83201f6dbf_JaffaCakes118.dll
Size

24KB
MD5

2d8b745e2a61588e0a79bb83201f6dbf
SHA1

11f77bbabe42acd47b85cb633669e888dd2cc6bc
SHA256

26bcba222058739e6a290edfba8519b7e8224810f34bfb3f557cd9ed5f76bdc3
SHA512

c8e6345f6a1cc6416be1610332d3d56e7130169ab041bd98318fdd38570f85b24216845d20bddbdbfb0c058e4eaeaf99cb500ce2f4ee124b02c8064cefde8e82
SSDEEP

192:0dSJolcY9UdzWMruIpjuBBQ6PRQkXMhMNn5WnN7i3khpIo:0dSJolazB7uBBQARQkchI5WRi3+p

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	2396	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 2396	1076	rundll32.exe	30
PID 1076 wrote to memory of 2396	1076	rundll32.exe	30
PID 1076 wrote to memory of 2396	1076	rundll32.exe	30
PID 1076 wrote to memory of 2396	1076	rundll32.exe	30
PID 1076 wrote to memory of 2396	1076	rundll32.exe	30
PID 1076 wrote to memory of 2396	1076	rundll32.exe	30
PID 1076 wrote to memory of 2396	1076	rundll32.exe	30
PID 2396 wrote to memory of 2988	2396	rundll32.exe	31
PID 2396 wrote to memory of 2988	2396	rundll32.exe	31
PID 2396 wrote to memory of 2988	2396	rundll32.exe	31
PID 2396 wrote to memory of 2988	2396	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d8b745e2a61588e0a79bb83201f6dbf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d8b745e2a61588e0a79bb83201f6dbf_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 232
    3⤵
    - Program crash
    PID:2988