9f5e0631ae0e44a2f421b1ff02fbb329e83e6f1f8c758d9cd500fc055fffbcd9

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 01:11

Target

2e7c48b5b6d35670bac0499ed2b6a2d4_JaffaCakes118.dll
Size

44KB
MD5

2e7c48b5b6d35670bac0499ed2b6a2d4
SHA1

347ee50e4f869cdb7aa28a8a6f4b160a500e229a
SHA256

9f5e0631ae0e44a2f421b1ff02fbb329e83e6f1f8c758d9cd500fc055fffbcd9
SHA512

8b98ff46c1ef1184713be4b66cbad95fccb6a6661c4e7e442f89566d682d9739b6628100449272d5ee75e98db088db573624cc0097a50b83c2f6e3aa0f4fd2b1
SSDEEP

768:cXvB/yuK+81EfdEx05UMnvDHC2+WhilczxmuZRJzMv:cXv19iGExcUMnvDHC2+3czx1Z

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2676	2788	WerFault.exe	31

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2788	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2788	2764	rundll32.exe	31
PID 2764 wrote to memory of 2788	2764	rundll32.exe	31
PID 2764 wrote to memory of 2788	2764	rundll32.exe	31
PID 2764 wrote to memory of 2788	2764	rundll32.exe	31
PID 2764 wrote to memory of 2788	2764	rundll32.exe	31
PID 2764 wrote to memory of 2788	2764	rundll32.exe	31
PID 2764 wrote to memory of 2788	2764	rundll32.exe	31
PID 2788 wrote to memory of 2676	2788	rundll32.exe	32
PID 2788 wrote to memory of 2676	2788	rundll32.exe	32
PID 2788 wrote to memory of 2676	2788	rundll32.exe	32
PID 2788 wrote to memory of 2676	2788	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e7c48b5b6d35670bac0499ed2b6a2d4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e7c48b5b6d35670bac0499ed2b6a2d4_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 456
    3⤵
    - Program crash
    PID:2676