f5f653b362d80ecd42701ba41c09dfd7ed39fc75fba1099401cd63a7107579a6

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 19:52

Target

3a81a9979ccf1c2c9224845d5d502daf_JaffaCakes118.dll
Size

1.1MB
MD5

3a81a9979ccf1c2c9224845d5d502daf
SHA1

44f916476fd7e349d2c440ff31366b02e490cafe
SHA256

f5f653b362d80ecd42701ba41c09dfd7ed39fc75fba1099401cd63a7107579a6
SHA512

b55864b724e1531462a197c42caab14712322ddc48877aab02237e25f34e8a3478112c4959bd444ee5787461556585e83b14eab771d937b4c09bacf6869c987a
SSDEEP

12288:ZcgDsSSTaSErIMF7sdTCGf+6aUj4Kv0dOjd:ZcggSrbIMWdZ+/9Sd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2192	2096	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2096	2864	rundll32.exe	30
PID 2864 wrote to memory of 2096	2864	rundll32.exe	30
PID 2864 wrote to memory of 2096	2864	rundll32.exe	30
PID 2864 wrote to memory of 2096	2864	rundll32.exe	30
PID 2864 wrote to memory of 2096	2864	rundll32.exe	30
PID 2864 wrote to memory of 2096	2864	rundll32.exe	30
PID 2864 wrote to memory of 2096	2864	rundll32.exe	30
PID 2096 wrote to memory of 2192	2096	rundll32.exe	31
PID 2096 wrote to memory of 2192	2096	rundll32.exe	31
PID 2096 wrote to memory of 2192	2096	rundll32.exe	31
PID 2096 wrote to memory of 2192	2096	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a81a9979ccf1c2c9224845d5d502daf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a81a9979ccf1c2c9224845d5d502daf_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 272
    3⤵
    - Program crash
    PID:2192