4782c9b8b15d2e84a0c1ec93ef3e9cea1f76c40bb32ca6bec6b2873634191cc6

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 21:16

Target

366a6febe218c5e42a2c38f1fe819802_JaffaCakes118.dll
Size

32KB
MD5

366a6febe218c5e42a2c38f1fe819802
SHA1

e9dd85b63987191f4285b254547afaf5d0cd3fbb
SHA256

4782c9b8b15d2e84a0c1ec93ef3e9cea1f76c40bb32ca6bec6b2873634191cc6
SHA512

8a6ca14ca47e98cf4e9512183f5f4a993665bae0f4b1a40c433c1a2b65622985179510f70fd960ef73e217fdcbc0ffe2b0ebe2fe1926f39b6cb4ab50c484051e
SSDEEP

768:nIDnb6ccqhO1eWrme5/kOM0tScFzSu0ZRJlt:nIn6ahO1L5/kORUcNqZL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1748	1044	WerFault.exe	29

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1044	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 1044	580	rundll32.exe	29
PID 580 wrote to memory of 1044	580	rundll32.exe	29
PID 580 wrote to memory of 1044	580	rundll32.exe	29
PID 580 wrote to memory of 1044	580	rundll32.exe	29
PID 580 wrote to memory of 1044	580	rundll32.exe	29
PID 580 wrote to memory of 1044	580	rundll32.exe	29
PID 580 wrote to memory of 1044	580	rundll32.exe	29
PID 1044 wrote to memory of 1748	1044	rundll32.exe	30
PID 1044 wrote to memory of 1748	1044	rundll32.exe	30
PID 1044 wrote to memory of 1748	1044	rundll32.exe	30
PID 1044 wrote to memory of 1748	1044	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\366a6febe218c5e42a2c38f1fe819802_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\366a6febe218c5e42a2c38f1fe819802_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 452
    3⤵
    - Program crash
    PID:1748