b8876ee48ac27f33e57d5c3cc3e28e0bceea6a2d2d4463b58e0f393fbd4f6ae1

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 01:05

Target

3f977b01dbb7b3121d8fa8b72c9d99e2_JaffaCakes118.dll
Size

244KB
MD5

3f977b01dbb7b3121d8fa8b72c9d99e2
SHA1

804ed9eac6b6952b8f685ebca6e80a1d683bb150
SHA256

b8876ee48ac27f33e57d5c3cc3e28e0bceea6a2d2d4463b58e0f393fbd4f6ae1
SHA512

afe9f86dfb59bbada6bb8d979b69e9bb7a822cb20bff4d178028de003716523551875af75414793e75494f379bf640f30397f329ff98021497124e0c6c807944
SSDEEP

3072:kYS7nCcolduuT8Cy/8EsmxEsmxEsmxEsmPYS7nCcolduuT8Cy/V:67Ing8ZgZgZgZ+7IngV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2080	2688	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 2688	1600	rundll32.exe	30
PID 1600 wrote to memory of 2688	1600	rundll32.exe	30
PID 1600 wrote to memory of 2688	1600	rundll32.exe	30
PID 1600 wrote to memory of 2688	1600	rundll32.exe	30
PID 1600 wrote to memory of 2688	1600	rundll32.exe	30
PID 1600 wrote to memory of 2688	1600	rundll32.exe	30
PID 1600 wrote to memory of 2688	1600	rundll32.exe	30
PID 2688 wrote to memory of 2080	2688	rundll32.exe	31
PID 2688 wrote to memory of 2080	2688	rundll32.exe	31
PID 2688 wrote to memory of 2080	2688	rundll32.exe	31
PID 2688 wrote to memory of 2080	2688	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f977b01dbb7b3121d8fa8b72c9d99e2_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f977b01dbb7b3121d8fa8b72c9d99e2_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 220
    3⤵
    - Program crash
    PID:2080