3051ffe84cad75873379ec999a58208c0cb519c8122abb01db3249409b3c1da4

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 20:21

Target

3a9654c954c0ee19e8359d6efa8f55c0_JaffaCakes118.dll
Size

72KB
MD5

3a9654c954c0ee19e8359d6efa8f55c0
SHA1

cf4028e7f11500b5c9a9fd2e0376a4d3bc42b30f
SHA256

3051ffe84cad75873379ec999a58208c0cb519c8122abb01db3249409b3c1da4
SHA512

1197a8b2a8243a46d08d93e4288ead9eea73cd46c2d0a82afd0ef92394ca1d5118ab52e2d7a2e3a09c500cc6897b6bf5c9e169e607b8e38a3247018f4fc3d966
SSDEEP

768:CTt1RNicLkIs+YTeSovO4Gk8oBt9FD83iB9AFqUqqZJu+clcMf:CTtwgs+YTejW9oygpflH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2672	2632	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2632	2072	rundll32.exe	30
PID 2072 wrote to memory of 2632	2072	rundll32.exe	30
PID 2072 wrote to memory of 2632	2072	rundll32.exe	30
PID 2072 wrote to memory of 2632	2072	rundll32.exe	30
PID 2072 wrote to memory of 2632	2072	rundll32.exe	30
PID 2072 wrote to memory of 2632	2072	rundll32.exe	30
PID 2072 wrote to memory of 2632	2072	rundll32.exe	30
PID 2632 wrote to memory of 2672	2632	rundll32.exe	31
PID 2632 wrote to memory of 2672	2632	rundll32.exe	31
PID 2632 wrote to memory of 2672	2632	rundll32.exe	31
PID 2632 wrote to memory of 2672	2632	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a9654c954c0ee19e8359d6efa8f55c0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a9654c954c0ee19e8359d6efa8f55c0_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 232
    3⤵
    - Program crash
    PID:2672