b47a82268dbb570c9bf65bfb1017fa5fc8cc7f13ff6156e2e6c05846cb8b54d9

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 07:32

Target

2f7a17dcbcfe92370dffc28c257537f6_JaffaCakes118.dll
Size

204KB
MD5

2f7a17dcbcfe92370dffc28c257537f6
SHA1

1c136dac161fbc0b4a647922c7bc138f7ad8dfcb
SHA256

b47a82268dbb570c9bf65bfb1017fa5fc8cc7f13ff6156e2e6c05846cb8b54d9
SHA512

0af1bb8676f5a540679f1794e79646fbec9b7995bb53c00252241ac5f633786aaed588bc6af7e6d3700c1107ffeef84e011699e789852a3f931fe23ef8198dd7
SSDEEP

3072:/PX+LxI7GWlMZdyDIT3v9nxRJ0lb5BvoVVp/PSccmRATm/0qHkcO5VnZrWOorsRd:xSm4xvootqDors3gk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3028	2456	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2456	2496	rundll32.exe	30
PID 2496 wrote to memory of 2456	2496	rundll32.exe	30
PID 2496 wrote to memory of 2456	2496	rundll32.exe	30
PID 2496 wrote to memory of 2456	2496	rundll32.exe	30
PID 2496 wrote to memory of 2456	2496	rundll32.exe	30
PID 2496 wrote to memory of 2456	2496	rundll32.exe	30
PID 2496 wrote to memory of 2456	2496	rundll32.exe	30
PID 2456 wrote to memory of 3028	2456	rundll32.exe	32
PID 2456 wrote to memory of 3028	2456	rundll32.exe	32
PID 2456 wrote to memory of 3028	2456	rundll32.exe	32
PID 2456 wrote to memory of 3028	2456	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f7a17dcbcfe92370dffc28c257537f6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f7a17dcbcfe92370dffc28c257537f6_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 256
    3⤵
    - Program crash
    PID:3028