91f23710db43797b091587ad10bd595866fd7e0b2ec3d433bb60f3907dd06986

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 20:00

Target

3eb0207aee15bb55c510dc36d7ade710_JaffaCakes118.dll
Size

28KB
MD5

3eb0207aee15bb55c510dc36d7ade710
SHA1

f1e172a71d1d67a97f9d14e38ced2c6607e8fac7
SHA256

91f23710db43797b091587ad10bd595866fd7e0b2ec3d433bb60f3907dd06986
SHA512

266a1c445c04c9e0d5b9c0070027cc16e69f5f0fccd08dae80348129577aa904e5b93523443492e7df3154d1d0b73f670474835e1f0274622294f80af1668cee
SSDEEP

96:I+RyuJU29DG1qN/T2+232+QAdeutQ1gEQyepnZ:RRyIU29DG1qh8gAIh5Ng

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2752	2740	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2740	2648	rundll32.exe	30
PID 2648 wrote to memory of 2740	2648	rundll32.exe	30
PID 2648 wrote to memory of 2740	2648	rundll32.exe	30
PID 2648 wrote to memory of 2740	2648	rundll32.exe	30
PID 2648 wrote to memory of 2740	2648	rundll32.exe	30
PID 2648 wrote to memory of 2740	2648	rundll32.exe	30
PID 2648 wrote to memory of 2740	2648	rundll32.exe	30
PID 2740 wrote to memory of 2752	2740	rundll32.exe	31
PID 2740 wrote to memory of 2752	2740	rundll32.exe	31
PID 2740 wrote to memory of 2752	2740	rundll32.exe	31
PID 2740 wrote to memory of 2752	2740	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eb0207aee15bb55c510dc36d7ade710_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eb0207aee15bb55c510dc36d7ade710_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 236
    3⤵
    - Program crash
    PID:2752