092b48d447be85fb30bd82e9c937d403c51dde2d01c974630791cc64b638e38a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 03:17

Target

3bcddff1e5291cfdf475e686bdb816e1_JaffaCakes118.dll
Size

148KB
MD5

3bcddff1e5291cfdf475e686bdb816e1
SHA1

88f1b4170f15aff1b1ccc48b2729ed12b2f3b4a9
SHA256

092b48d447be85fb30bd82e9c937d403c51dde2d01c974630791cc64b638e38a
SHA512

eaef85ca00efe571f9c93b14ccd47b4f02a50d0881a68cf9d014289686820ac1e47532917ae9ab52c1d3cdc59ab66dd305e91b1568de591939c806b12049cacd
SSDEEP

3072:Myf+rm7a44gP/Tz3mcwNvSZ4xPy+HTBftefoHtPQH:Dma7PB/vQ62xPy+HTBlefoHtPm

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rundll32.exe.txt	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2520	828	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 828	2104	rundll32.exe	30
PID 2104 wrote to memory of 828	2104	rundll32.exe	30
PID 2104 wrote to memory of 828	2104	rundll32.exe	30
PID 2104 wrote to memory of 828	2104	rundll32.exe	30
PID 2104 wrote to memory of 828	2104	rundll32.exe	30
PID 2104 wrote to memory of 828	2104	rundll32.exe	30
PID 2104 wrote to memory of 828	2104	rundll32.exe	30
PID 828 wrote to memory of 2520	828	rundll32.exe	31
PID 828 wrote to memory of 2520	828	rundll32.exe	31
PID 828 wrote to memory of 2520	828	rundll32.exe	31
PID 828 wrote to memory of 2520	828	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bcddff1e5291cfdf475e686bdb816e1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bcddff1e5291cfdf475e686bdb816e1_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 228
    3⤵
    - Program crash
    PID:2520